---
title: "Exchange for a short-lived token"
method: POST
path: "/api/v1/gateway/token"
---

# Exchange for a short-lived token

`POST /api/v1/gateway/token`

## Request

- Base URL: `https://app.axiorank.com`
- URL: `https://app.axiorank.com/api/v1/gateway/token`
- Auth: one of:
  - HTTP bearer
  - none

Exchange a long-lived credential for a short-lived, scoped `axr_tok_…` token (tokens can only NARROW scopes, never widen them). Two grants: **key exchange**, present an `axr_live_`/`axr_test_` key in the `Authorization` header; **federated**, present a platform OIDC token as `subject_token` in the body (no AxioRank secret stored on the agent).

## Request body

- TokenExchangeRequest
  - `grant_type` 'api_key' | 'federated'
  - `subject_token` string
  - `ttl_seconds` integer
  - `scopes` string[]

## Response `200`

The minted token.

- TokenResponse
  - `token` string, required: A short-lived `axr_tok_…` bearer token.
  - `token_type` 'Bearer', required
  - `expires_at` string, date-time, required
  - `expires_in` integer, required: Lifetime in seconds.
  - `scopes` string[], required

## Other responses

- `400`: Malformed body or invalid `subject_token`.
- `401`: Missing or invalid credential.
- `403`: Requested scopes are not permitted by the credential.

---

[API](https://skmtc.dev/axiorank/apis/axiorank-gateway-api.md) · [All operations](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/llms.txt) · [OpenAPI document](https://skmtc.dev/axiorank/apis/axiorank-gateway-api/revisions/d8a7a33656e4?raw)