OAuth

Exchange a workload identity token

Changed on

RFC 8693 token exchange. Presents a JWT from an issuer your organization trusts (Settings → Workload identity) and receives a short-lived OpenRouter access token that acts as the API key the matching federation policy targets.

post/oauth/token

Request

  • Base URL: https://openrouter.ai/api/v1
  • URL: https://openrouter.ai/api/v1/oauth/token
  • Auth: HTTP bearer

Response

Access token issued

access_tokenstring required

A short-lived JWT to send as Authorization: Bearer to the inference API.

expires_ininteger required

Seconds until the access token expires: at most 15 minutes, and never later than the subject token expires.

issued_token_type'urn:ietf:params:oauth:token-type:access_token' required
scopestring required

The one capability the token grants, fixed by the kind of key the policy acts as: inference or management.

token_type'Bearer' required

Example response

{
  "access_token": "<short-lived openrouter access token jwt>",
  "expires_in": 900,
  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "scope": "inference",
  "token_type": "Bearer"
}

Changes