---
title: "Renew this runtime's own agent JWT before it expires"
method: POST
path: "/v1/runtimes/{runtime_id}/agent-token/renew"
tags: ["Runtimes"]
---

# Renew this runtime's own agent JWT before it expires

`POST /v1/runtimes/{runtime_id}/agent-token/renew`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/runtimes/{runtime_id}/agent-token/renew`
- Auth: HTTP bearer

Called by the runtime container itself, not by a human or an external client.
A runtime's `ONECLAW_AGENT_TOKEN` is a short-lived JWT that Cloud Run resolves from Secret Manager when the instance starts and never again, so a container that outlives the TTL loses its credential — and with it every 1claw tool — until it is restarted. This lets it replace the token in place instead.
Authenticated by the credential being renewed: the caller must present a still-valid runtime-bound agent JWT together with a matching `X-1Claw-Runtime-Id` header, and must be the agent that runtime is bound to. It grants nothing new — the same claims with a later expiry — and stops working the moment the token lapses, the token is revoked, the agent is suspended, or the runtime is no longer deployed. Exempt from the monthly request quota: upkeep of an already-paid-for runtime is not itself a billable request.

## Response `200`

A fresh access token

- object
  - `access_token` string
  - `expires_in` integer
  - `token_type` string

## Other responses

- `400`: The runtime is not deployed, so it has nothing to renew
- `401`: Unauthenticated, or the token presented has already expired
- `403`: Not an agent caller
- `404`: No such runtime, or it is not bound to this agent

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)