secrets

Sign a JWT with a key stored in a saved secret without revealing the key.

Sign a JWT with a key stored in a saved secret without revealing the key. HMAC algorithms (HS256, HS384, HS512) use key material from the secret; RS*, PS*, ES*, and EdDSA use a PKCS#8 PEM private key. This generic primitive only signs caller-provided header and claims; package or execute code should perform any OAuth token exchange separately.

Org permission: secret:use.

post/v1/secrets/jwt

Request

  • Base URL: https://api.kody.codes
  • URL: https://api.kody.codes/v1/secrets/jwt
  • Auth: HTTP bearer

Request body

private_key_secret_namestring required

Saved signing-key secret name, or an opaque {{secret:…}} ref from packageSecrets.get. PKCS#8 PEM for RS*, PS*, ES*, and EdDSA, or HMAC key material for HS*.

private_key_secret_scope'session' | 'package' | 'user'

Optional secret scope. When omitted, Kody checks accessible scopes in precedence order.

private_key_json_fieldstring

Optional JSON object field containing the signing key, for example "private_key" for service-account JSON.

algorithm'RS256' | 'RS384' | 'RS512' | 'PS256' | 'PS384' | 'PS512' | 'ES256' | 'ES384' | 'ES512' | 'EdDSA' | 'HS256' | 'HS384' | 'HS512'
key_encoding'base64' | 'utf8' | 'base64url'

HMAC key encoding when algorithm is HS256, HS384, or HS512. Defaults to base64 (DoorDash Drive signing_secret). Not valid for RS*, PS*, ES*, or EdDSA.

headerobject

Optional JWT header fields. "alg" must match the requested algorithm when provided.

claimsobject required

JWT claims to sign.

Response

Success.

jwtstring required
algorithm'RS256' | 'RS384' | 'RS512' | 'PS256' | 'PS384' | 'PS512' | 'ES256' | 'ES384' | 'ES512' | 'EdDSA' | 'HS256' | 'HS384' | 'HS512' required

Changes

No recorded changes to this operation across all 2 revisions of this API.