oauth

Exchange Token

Changed on

Exchange an identity token for an access token (the RFC 7523 jwt-bearer grant).

The identity token must verify against an issuer on federation_issuers and match the federation rule federation_rule_id names. organization_id, workspace_id and service_account_id, where set, must be the UUIDs of the rule's key's organization and workspace and the key's id. The access token authenticates as that key until expires_in runs out, the rule is deleted or the key stops passing its checks.

Every refusal of the identity token answers 401 invalid_grant with the same description.

post/api/v1/oauth/token

Request

  • The document declares no server URL.
  • Auth: one of:
    • API key in header Otari-Key
    • API key in header x-api-key

Request body

assertionstring nullable

The identity token.

federation_rule_idstring nullable

The id of the federation rule the identity token must match.

grant_typestring nullable

urn:ietf:params:oauth:grant-type:jwt-bearer

organization_idstring nullable

When set, the UUID of the organization of the rule's key.

service_account_idstring nullable

When set, the id of the rule's key.

workspace_idstring nullable

When set, the UUID of the rule's key's workspace.

Example request

{
  "assertion": "<identity token>",
  "federation_rule_id": "7d0c7a52-9a2e-4b55-8f3a-2f1f6c0d2a11",
  "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
  "organization_id": "5b3f8e0e-1c2d-4e7f-9a8b-0c1d2e3f4a5b"
}

Response

Successful Response

access_tokenstring required
expires_ininteger required

Seconds until the access token expires.

token_typestring

Changes