Universal Print (UP) Printer Access Token Retrieval
Important
The printer must already be registered with Universal Print in order to retrieve its access token.
To get an access token that represents the printer, the printer will have to generate a JSON Web Token (JWT) and sign it with its certificate private key.
The procedure is as follows:
- Request a Nonce from the device token endpoint.
- Generate a device JWT with the proper information and sign it with the private key.
- Send a request to the device token endpoint with the JWT in the body.
1 Requesting a Nonce
To request a nonce, send a POST request to the device token endpoint with the body containing a server challenge.
1.1 HTTP Request
POST {device_token_url}
{device_token_url} is the URL received from the successful registration response.
1.2 Request Content-Type
application/x-www-form-urlencoded
1.3 Request Payload
grant_type=srv_challenge&windows_api_version=2.0
1.4 Successful Response
Returns 200 OK and the Nonce in the response payload in JSON format with the following values (case sensitive):
| Value name | Value type | Description | Required |
|---|---|---|---|
| Nonce | string | The nonce string to be used with the token request. | Yes |
1.5 Examples
1.5.1 Request
POST https://login.microsoftonline.com/425a8e89-feb9-40d2-9fe5-07fb45419e4b/oauth2/token HTTP/1.1
Host: login.microsoftonline.com
Content-Length: 48
grant_type=srv_challenge&windows_api_version=2.0
1.5.2 Response
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 132
{
"Nonce": "AQABAAAAAADX8GCi6Js6SK82TsD2Pb7rO4c24C6C31bER-HgavkQr-xx11qx0DFkaB6rfm-ikMj\_eUCSQ12bS4Id06ae1CUQjd8jN7xc4uGK-PA6Bj83HyAA"
}
2 Generating the device JWT
The generated device JWT will contain the information needed for the token provider to issue a device access token to the printer. The next sections will detail the information needed in the JWT header, body and signature.
2.1 The JWT Header
The following JWT header parameters are needed:
| Value name | Value type | Description | Required |
|---|---|---|---|
| alg | string | The public key algorithm used to generate the public key. Must match the registration request information which should be "RS256". | Yes |
| typ | string | The type header parameter. Should be "JWT". | Yes |
| x5c | string | The full body of the device certificate (contains public key only). This is the certificate returned by the successful registration response. | Yes |
2.2 The JWT Body
The following JWT body parameters are needed:
| Value name | Value type | Description | Required |
|---|---|---|---|
| request_nonce | string | The nonce value obtained in section 1. | Yes |
| grant_type | string | The fixed literal string "device_token" that indicates to the server a device only token is needed. | Yes |
| resource | string | The target audience of the access token. This is the 'mcp_svc_resource_id' value returned by the successful Completed registration response. For example, https://print.print.microsoft.com | Yes |
| client_id | string | The Application (Client) ID of a registered Azure Application with API permissions to Universal Print. To create an Azure Application with the proper API permissions please refer to OEM client ID registration. | Yes |
| redirect_uri | string | A configured Redirect URI for the registered Azure Application used for 'client_id' in this section. To configure a Redirect URI for a registered Azure Application please follow OEM client ID registration. | Yes |
| iss | string | The Cloud Device ID the printer received from the successful registration response. | Yes |
2.3 The JWT Signature
The JWT signed by the device private key, which is used to prove that request was issued from device, and not replayed from a different one.
2.4 Example Generated JWT
{
"alg": "RS256",
"typ": "JWT",
"x5c": "MIID8jCCAtqgAwIBAgIQtJE/zIv3C5JOPoIeezhfLzANBgkqhkiG9w0BAQsFADB4MXYwEQYKCZImiZPyLGQBGRYDbmV0MBUGCgmSJomT8ixkARkWB3dpbmRvd3MwHQYDVQQDExZNUy1Pcmdhbml6YXRpb24tQWNjZXNzMCsGA1UECxMkODJkYmFjYTQtM2U4MS00NmNhLTljNzMtMDk1MGMxZWFjYTk3MB4XDTE4MDUxMDAzMjUzMVoXDTI4MDUxMDAzNTUzMVowLzEtMCsGA1UEAxMkZTlhNjc1YTItYTdjNS00ZmU3LThlODMtZmUxZWZhZjgyZWM2MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjGw0ePNEZTNgDbTMMb+m8feCQY70yotozZnMFh5HehO2AvlaR1mZnAI+7rWd5pUdmPo83wGSchqj4cOsOQF699UEmZllDDpCMd9e/kkyFFQYVFBjLV67jUNyM5yDwCqSsNyTImuBQjpgOCoYt7nrsJ5nlaEiWB7HNMbPEJI8Szp9eMci/5j5ktRqU9SeWBUF7SIruaFKt5i7phTwx9ELJo554/yaQtJx5gZs1hpO/z9iLORu+13cj5aruvNZFnlyNyD7LNZ43J5biIIuqbFaUhCLBX70vuE/yhxkKjvyZwovP1PP5Bqc7ZLD6vIdh80bgJLd+xFKbL4OcD2DgxWI4QIDAQABo4HAMIG9MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwIwIgYLKoZIhvcUAQWCHAIEEwSBEKJ1punFp+dPjoP+Hvr4LsYwIgYLKoZIhvcUAQWCHAMEEwSBEHlLkyG0XmRHoNfDVt0FSVQwIgYLKoZIhvcUAQWCHAUEEwSBEImOWkK5/tJAn+UH+0VBnkswFAYLKoZIhvcUAQWCHAgEBQSBAk5BMBMGCyqGSIb3FAEFghwHBAQEgQEwMA0GCSqGSIb3DQEBCwUAA4IBAQB3q4Ey9AijQmHy0S3+fy1PV7pXq6aMhAgF7HvzmEwdmnjSCfvUd+fPkZA3tGQ6gkGlJ3mI4wq0xBZfk6YEQLLSuvukCphzZitz2NnpeCYMYpT2L7G1+EsIMu5+Wz84S4IO57IMBSLMDmsLLP2bHq+w1VOYgS9cO7Vha/nR3Z542LnaRKINUpFedHAtffv2tOQLRCPWk20KP5LEpKuEcM/r5EHFH6beKFuYePpJ7/dhKH69cZFWRtqgaV7BHxeDVr/n3kyHbDv1rwTXIYHaM3qEXDcSmyqEZqu0WEoz0FpVYt2pRw9pSb29+Y6n4vWTyWxVI8zMqDieYmaw7uXctqrr"
}.
{
"request_nonce": "AQABAAAAAADX8GCi6Js6SK82TsD2Pb7rO4c24C6C31bER-HgavkQr-xx11qx0DFkaB6rfm-ikMj\_eUCSQ12bS4Id06ae1CUQjd8jN7xc4uGK-PA6Bj83HyAA",
"grant_type": "device_token",
"resource": "https://microsoft.com/mcp",
"client_id": "1ef464e5-0b61-4c6f-b822-5dc015b9463e",
"redirect_uri": "https://print.print.microsoft.com/",
"iss": "e9a675a2-a7c5-4fe7-8e83-fe1efaf82ec6"
}.
[Signature]
3 Requesting a Device Access Token
To request a device token, send a POST request to the device token endpoint with the body containing the JWT generated in section 2.
3.1 HTTP Request
POST {device_token_url}
{device_token_url} is the URL received from the successful registration response.
3.2 Request Content-Type
application/x-www-form-urlencoded
3.3 Request Payload
Form URL encoded format with the following name/value pairs:
| Value name | Description/Value | Required |
|---|---|---|
| grant_type | Should be set to urn:ietf:params:oauth:grant-type:jwt-bearer. This indicates that the token request is described in a JWT. |
Yes |
| request | The Base-64 encoded JWT that was generated in section 2. | Yes |
Important
Make sure that 'cookies' are not included when sending the device token request. Sending cookies could result in unexpected behavior.
3.4 Successful Response
Returns 200 OK and the Access Token in the response payload in JSON format with the following main values (case sensitive):
| Value name | Value type | Description | Required |
|---|---|---|---|
| access_token | string | The requested access token as a signed JSON Web Token (JWT). The printer can use this token to authenticate to the secured resource, such as a web API. | Yes |
| token_type | string | Indicates the token type value. The only type that should be returned is currently Bearer. | Yes |
| device_info | string | A JWT representing the device. | Yes |
| expires_in | string | How long the access token is valid (in seconds). | Yes |
| expires_on | string | The time when the access token expires. The date is represented as the number of seconds from 1970-01-01T0:0:0Z UTC until the expiration time. This value is used to determine the lifetime of cached tokens. | Yes |
| not_before | string | The time before which the JWT MUST NOT be accepted for processing. | Yes |
| resource | string | The App ID URI of the web API (secured resource). | Yes |
3.5 Error Response
The detailed error responses are described here: Use the authorization code to request an access token
The response payload is in JSON format with the following main values (case sensitive):
| Value name | Value type | Description | Required |
|---|---|---|---|
| error | string | An error code string that can be used to classify types of errors that occur, and can be used to react to errors. | Yes |
| error_description | string | A specific error message that can help a developer identify the root cause of an authentication error. | No |
| error_codes | Array of integers | A list of STS-specific error codes that can help in diagnostics. | No |
| timestamp | string | The time at which the error occurred. | No |
| trace_id | string | A unique identifier for the request that can help in diagnostics. | No |
| correlation_id | string | A unique identifier for the request that can help in diagnostics across components. | No |
3.5.1 Critical Error
If the printer has been de-registered from the UP portal or the certificate expires, then the printer will fail to get a device access token. In this case, the device token endpoint will return "error": "invalid_grant" and "suberror": "device_authentication_failed". At this point, the printer should reset its state to be Unregistered as the device will need to be re-registered.
For example:
{
"error": "invalid_grant",
"error_description": "AADSTS70002: Error validating credentials. AADSTS50155: Device is not authenticated.\\r\\nTrace ID: b099e7ad-ccf8-4eb7-b105-cced2f724d00\\r\\nCorrelation ID: 0d72010c-5a1f-4c19-99a7-48df28c5db66\\r\\nTimestamp: 2018-05-14 01:06:51Z",
"error_codes": [70002, 50155],
"trace_id": "b099e7ad-ccf8-4eb7-b105-cced2f724d00",
"correlation_id": "0d72010c-5a1f-4c19-99a7-48df28c5db66",
"suberror": "device_authentication_failed"
}
3.6 Examples
3.6.1 Request
POST https://login.microsoftonline.com/425a8e89-feb9-40d2-9fe5-07fb45419e4b/oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept-Charset: utf-8
Host: login.microsoftonline.com
Content-Length: 2737
grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&request=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsIng1YyI6Ik1JSUQ4akNDQXRxZ0F3SUJBZ0lRdEpFL3pJdjNDNUpPUG9JZWV6aGZMekFOQmdrcWhraUc5dzBCQVFzRkFEQjRNWFl3RVFZS0NaSW1pWlB5TEdRQkdSWURibVYwTUJVR0NnbVNKb21UOGl4a0FSa1dCM2RwYm1SdmQzTXdIUVlEVlFRREV4Wk5VeTFQY21kaGJtbDZZWFJwYjI0dFFXTmpaWE56TUNzR0ExVUVDeE1rT0RKa1ltRmpZVFF0TTJVNE1TMDBObU5oTFRsak56TXRNRGsxTUdNeFpXRmpZVGszTUI0WERURTRNRFV4TURBek1qVXpNVm9YRFRJNE1EVXhNREF6TlRVek1Wb3dMekV0TUNzR0ExVUVBeE1rWlRsaE5qYzFZVEl0WVRkak5TMDBabVUzTFRobE9ETXRabVV4WldaaFpqZ3laV00yTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFqR3cwZVBORVpUTmdEYlRNTWIrbThmZUNRWTcweW90b3pabk1GaDVIZWhPMkF2bGFSMW1abkFJKzdyV2Q1cFVkbVBvODN3R1NjaHFqNGNPc09RRjY5OVVFbVpsbEREcENNZDllL2treUZGUVlWRkJqTFY2N2pVTnlNNXlEd0NxU3NOeVRJbXVCUWpwZ09Db1l0N25yc0o1bmxhRWlXQjdITk1iUEVKSThTenA5ZU1jaS81ajVrdFJxVTlTZVdCVUY3U0lydWFGS3Q1aTdwaFR3eDlFTEpvNTU0L3lhUXRKeDVnWnMxaHBPL3o5aUxPUnUrMTNjajVhcnV2TlpGbmx5TnlEN0xOWjQzSjViaUlJdXFiRmFVaENMQlg3MHZ1RS95aHhrS2p2eVp3b3ZQMVBQNUJxYzdaTEQ2dklkaDgwYmdKTGQreEZLYkw0T2NEMkRneFdJNFFJREFRQUJvNEhBTUlHOU1Bd0dBMVVkRXdFQi93UUNNQUF3RmdZRFZSMGxBUUgvQkF3d0NnWUlLd1lCQlFVSEF3SXdJZ1lMS29aSWh2Y1VBUVdDSEFJRUV3U0JFS0oxcHVuRnArZFBqb1ArSHZyNExzWXdJZ1lMS29aSWh2Y1VBUVdDSEFNRUV3U0JFSGxMa3lHMFhtUkhvTmZEVnQwRlNWUXdJZ1lMS29aSWh2Y1VBUVdDSEFVRUV3U0JFSW1PV2tLNS90SkFuK1VIKzBWQm5rc3dGQVlMS29aSWh2Y1VBUVdDSEFnRUJRU0JBazVCTUJNR0N5cUdTSWIzRkFFRmdod0hCQVFFZ1FFd01BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQjNxNEV5OUFpalFtSHkwUzMrZnkxUFY3cFhxNmFNaEFnRjdIdnptRXdkbW5qU0NmdlVkK2ZQa1pBM3RHUTZna0dsSjNtSTR3cTB4QlpmazZZRVFMTFN1dnVrQ3BoelppdHoyTm5wZUNZTVlwVDJMN0cxK0VzSU11NStXejg0UzRJTzU3SU1CU0xNRG1zTExQMmJIcSt3MVZPWWdTOWNPN1ZoYS9uUjNaNTQyTG5hUktJTlVwRmVkSEF0ZmZ2MnRPUUxSQ1BXazIwS1A1TEVwS3VFY00vcjVFSEZINmJlS0Z1WWVQcEo3L2RoS0g2OWNaRldSdHFnYVY3Qkh4ZURWci9uM2t5SGJEdjFyd1RYSVlIYU0zcUVYRGNTbXlxRVpxdTBXRW96MEZwVll0MnBSdzlwU2IyOStZNm40dldUeVd4Vkk4ek1xRGllWW1hdzd1WGN0cXJyIn0.eyJyZXF1ZXN0X25vbmNlIjoiQVFBQkFBQUFBQURYOEdDaTZKczZTSzgyVHNEMlBiN3JPNGMyNEM2QzMxYkVSLUhnYXZrUXIteHgxMXF4MERGa2FCNnJmbS1pa01qX2VVQ1NRMTJiUzRJZDA2YWUxQ1VRamQ4ak43eGM0dUdLLVBBNkJqODNIeUFBIiwiZ3JhbnRfdHlwZSI6ImRldmljZV90b2tlbiIsInJlc291cmNlIjoiaHR0cHM6Ly9taWNyb3NvZnQuY29tL21jcC1wcGUiLCJjbGllbnRfaWQiOiIxZWY0NjRlNS0wYjYxLTRjNmYtYjgyMi01ZGMwMTViOTQ2M2UiLCJyZWRpcmVjdF91cmkiOiJodHRwczovL21jcC1wcGUuYXp1cmV3ZWJzaXRlcy5uZXQvIiwiaXNzIjoiZTlhNjc1YTItYTdjNS00ZmU3LThlODMtZmUxZWZhZjgyZWM2In0.bmvBY7cdD\_dGtbB9dXbjbj5qc5k9ssqOMe1KQnnUnChLz1nkgBMLU\_jBMwsAoHCvI\_udQAdDgyNmWFcnWxTY0sLARZ6FQmjbGclqrqhj\_kkJXdkNBdGcwIXafjQiFkpDlpTMbVjBWoQq49aW-e\_OcmfsVIg8DCdS-s87x0fJ3fuHzZJzVGEHC4D-43EPxWTXfVbsvOV7RNK15lq5GXm10W4DkRngK6EpMq69g75KCUqT\_MEEh5dGezl5Kic8RLZQ72n5aEpc5Y6XK85b1TdOtBnxogVjJFSsxpz1sOIpODszVu9CSUg4CHEjadpKQ9DiYCg6zB9D5fYbMf3NrGWC9Q
3.6.2 Response
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Content-Length: 2473
{
"token_type":"Bearer",
"expires_in":"3599",
"ext_expires_in":"0",
"expires_on":"1525928144","not_before":"1525924244","resource":"<https://microsoft.com/mcp>",
"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImlCakwxUmNxemhpeTRmcHhJeGRacW9oTTJZayIsImtpZCI6ImlCakwxUmNxemhpeTRmcHhJeGRacW9oTTJZayJ9.eyJhdWQiOiJodHRwczovL21pY3Jvc29mdC5jb20vbWNwLXBwZSIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzQyNWE4ZTg5LWZlYjktNDBkMi05ZmU1LTA3ZmI0NTQxOWU0Yi8iLCJpYXQiOjE1MjU5MjQyNDQsIm5iZiI6MTUyNTkyNDI0NCwiZXhwIjoxNTI1OTI4MTQ0LCJhbXIiOlsicnNhIl0sImRldmljZWlkIjoiZTlhNjc1YTItYTdjNS00ZmU3LThlODMtZmUxZWZhZjgyZWM2IiwiaWRwIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvNDI1YThlODktZmViOS00MGQyLTlmZTUtMDdmYjQ1NDE5ZTRiLyIsImlkdHlwIjoiZGV2aWNlIiwiaXBhZGRyIjoiMTY3LjIyMC4wLjc0Iiwib2lkIjoiZjM5NjNiMDItY2NjNS00NTg5LTkwYjQtMDJkNTA0OWE5ZGY3Iiwic3ViIjoiZTlhNjc1YTItYTdjNS00ZmU3LThlODMtZmUxZWZhZjgyZWM2IiwidGlkIjoiNDI1YThlODktZmViOS00MGQyLTlmZTUtMDdmYjQ1NDE5ZTRiIiwidXRpIjoiV005dVBHbXltRWV3RmdpMl9PcEdBQSIsInZlciI6IjEuMCJ9.gjCICKD2NT69bro4wK8r6SJhP6CBflnBqmlpF3pITl\_1Klv1DNYTue7a-Tup0vkFu0inN8njTG7rxlK\_j4m2mn1iUuh6CO-o98hN6VzjrarvZceBzGtsiOU2jtdacWP4JmePtTaXRmGDlK-PbTLy\_v4VmbL\_cQN2RIEiwf81suwnBacko0xbQhO3cPmGwKZcB5kFV4tnHp0uBnxyfcpRfV-ZR9Age41LWDW1ulOsTVuv1Q4XmmOmStkh2-TH1jOq1did6jyK1LKncdsSvEhKeo49-yBNshGntPs24qWL2WShz5cMQ3w5OBbAUOwl1DL-\_NtcUjCwbaLRwS6Dyliejw\",\"device\_info\":\"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6ImlCakwxUmNxemhpeTRmcHhJeGRacW9oTTJZayIsImtpZCI6ImlCakwxUmNxemhpeTRmcHhJeGRacW9oTTJZayJ9.eyJhdWQiOiJiYWZjYjg2Zi1kYWFhLTQxYjEtYjQ5NC04NjA0MzZhNGMzMGQiLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80MjVhOGU4OS1mZWI5LTQwZDItOWZlNS0wN2ZiNDU0MTllNGIvIiwiaWF0IjoxNTI1OTI0MjQ0LCJuYmYiOjE1MjU5MjQyNDQsImV4cCI6MTUyNTkyODE0NCwiZGV2aWNlaWQiOiJlOWE2NzVhMi1hN2M1LTRmZTctOGU4My1mZTFlZmFmODJlYzYiLCJpZHAiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80MjVhOGU4OS1mZWI5LTQwZDItOWZlNS0wN2ZiNDU0MTllNGIvIiwiaWR0eXAiOiJkZXZpY2UiLCJvaWQiOiJmMzk2M2IwMi1jY2M1LTQ1ODktOTBiNC0wMmQ1MDQ5YTlkZjciLCJzdWIiOiJlOWE2NzVhMi1hN2M1LTRmZTctOGU4My1mZTFlZmFmODJlYzYiLCJ0aWQiOiI0MjVhOGU4OS1mZWI5LTQwZDItOWZlNS0wN2ZiNDU0MTllNGIiLCJ1dGkiOiJXTTl1UEdteW1FZXdGZ2kyX09wR0FBIiwidmVyIjoiMS4wIn0.CPNbz9Cr20Ig\_i7Fc8GUx1NVpGXqQs9HsNH3F-QxUeJsep7m1rwiTE8WXsfXxiNGco0j1HFykiHdAsE\_-ymeVXaUtA5InC3uEeiHuIihQGbo9GC5gibzjsS\_psfqE74v\_9o7WuJTjFhpGdl1h57sOX49la312uR\_Khr6I6tIGiFon-gn4rGq5U0O4NV\_5LeitiHUXxuVxD2O9J5vERpwmnQ0UtyxX9skyFGEtcEruNch6noy\_5710xbcYv-8uO4VM8tM6CoqigWg\_7o18OciJ0VRBmsFLZtJUOxVSlPKeFneFDyKujpttbMIP-0-FdS75qckkqGYzoVbSuzsIcJa5g"
}