# OpenAM Administration Guide
13.1.1. OpenAM as OAuth 2.0 Authorization Server

Sidebar | Prev | Up | Next

#### 13.1.1.6. OpenAM OAuth 2.0 Endpoints

In addition to the standard authorization and token endpoints described in RFC 6749, OpenAM also exposes a token information endpoint for resource servers to get information about access tokens so they can determine how to respond to requests for protected resources. OpenAM as authorization server exposes the following endpoints for clients and resource servers.

`/oauth2/authorize`

  Authorization endpoint defined in RFC 6749, used to obtain an authorization grant from the resource owner

  Example: `https://openam.example.com:8443/openam/oauth2/authorize`

`/oauth2/access_token`

  Token endpoint defined in RFC 6749, used to obtain an access token from the authorization server

  Example: `https://openam.example.com:8443/openam/oauth2/access_token`

`/oauth2/tokeninfo`

  Endpoint not defined in RFC 6749, used to validate tokens, and to retrieve information such as scopes

  Given an access token, a resource server can perform an HTTP GET on `/oauth2/tokeninfo?access_token=`token-id`` to retrieve a JSON object indicating `token_type`, `expires_in`, `scope`, and the `access_token` ID.

  Example: `https://openam.example.com:8443/openam/oauth2/tokeninfo`

For examples, see the Developer's Guide section, OAuth 2.0 Authorization.