---
title: "Renew machine AUTHENTICATION: exchange a renewal root credential for a short-lived Work Identity Token. Authenticate with the Agent Identity's dedicated renewal credential (fbzr_...), or with a legacy credential explicitly bound to that Agent Identity during rollout. A Work Identity Token may NOT call this endpoint. The caller cannot choose identity, workspace, actor, membership, grant, scopes, capabilities or any other authority: all of it is derived server-side from the credential binding, so renewal can never become authority mutation. Maximum lifetime is 86400 seconds."
method: POST
path: "/identity/token"
---

# Renew machine AUTHENTICATION: exchange a renewal root credential for a short-lived Work Identity Token. Authenticate with the Agent Identity's dedicated renewal credential (fbzr_...), or with a legacy credential explicitly bound to that Agent Identity during rollout. A Work Identity Token may NOT call this endpoint. The caller cannot choose identity, workspace, actor, membership, grant, scopes, capabilities or any other authority: all of it is derived server-side from the credential binding, so renewal can never become authority mutation. Maximum lifetime is 86400 seconds.

`POST /identity/token`

## Request

- Base URL: `https://forbiz.io/api/public/agent`
- URL: `https://forbiz.io/api/public/agent/identity/token`
- Auth: HTTP bearer

## Request body

- object
  - `ttlSeconds` integer: Requested lifetime in seconds. Clamped server-side to [60, 86400]; the ceiling is never exceeded.

## Response `200`

A short-lived Work Identity Token. Use it as the Bearer token for business calls until expires_at, then renew.

- object
  - `access_token` string
  - `token_type` 'Bearer'
  - `expires_at` string, date-time
  - `expires_in` integer

## Other responses

- `400`: caller_selected_authority_rejected — the request tried to supply identityId, workspaceId, actorId, membershipId, grantId, scopes, capabilities or authority. None of those may ever be caller-selected.
- `401`: invalid_renewal_credential (invalid, revoked or expired renewal credential) or identity_token_expired.
- `403`: identity_token_cannot_renew — a Work Identity Token attempted to mint another Work Token; or renewal_binding_required — this legacy credential is not explicitly bound to an Agent Identity.

---

[API](https://skmtc.dev/forbiz/apis/forbiz-external-agent-api.md) · [All operations](https://skmtc.dev/forbiz/apis/forbiz-external-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/forbiz/apis/forbiz-external-agent-api/revisions/e5b10d59dc5f?raw)