Authentication

Exchange a 1claw token for an OIDC federation token (RFC 8693)

Mints a short-lived RS256-signed JWT targeted at an external relying party (e.g. Anthropic Workload Identity Federation). The relying party validates the token via this issuer's JWKS URL (/.well-known/jwks.json) and exchanges it for its own short-lived service credentials.

Requirements:

  • The agent that owns the subject_token must have federation_enabled = true and the requested audience must appear in federation_audiences.
  • The subject_token must be a valid 1claw agent JWT or ocv_ API key.
  • Optional scope narrows the agent's existing scopes — it cannot escalate.

Returns 503 when ONECLAW_JWT_RS256_SIGNING_KEY_ID is not configured on the server.

post/v1/auth/federated-token

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/auth/federated-token
  • Auth: none required

Request body

grant_type'urn:ietf:params:oauth:grant-type:token-exchange' required
subject_tokenstring required

1claw JWT or ocv_ API key authorising the exchange.

subject_token_type'urn:ietf:params:oauth:token-type:jwt' | 'urn:1claw:params:oauth:token-type:api-key' required
audiencestring uri required

Required aud claim for the issued federation token (must be in agent's allowlist).

scopestring

Optional space-separated subset of the agent's existing scopes.

requested_token_typestring

Optional. Defaults to urn:ietf:params:oauth:token-type:jwt.

Example request

{
  "audience": "https://api.anthropic.com"
}

Response

Federation token issued

access_tokenstring required

RS256-signed federation JWT.

issued_token_typestring required
token_typestring required
expires_ininteger required
scopestring

Changes

No recorded changes to this operation across all 1 revision of this API.