---
title: "Exchange a workload identity token"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Exchange a workload identity token

`POST /oauth/token`

RFC 8693 token exchange. Presents a JWT from an issuer your organization trusts (Settings → Workload identity) and receives a short-lived OpenRouter access token that acts as the API key the matching federation policy targets.

## Response `200`

Access token issued

- TokenExchangeResponse — RFC 8693 token exchange response.
  - `access_token` string, required — A short-lived JWT to send as `Authorization: Bearer` to the inference API.
  - `expires_in` integer, required — Seconds until the access token expires: at most 15 minutes, and never later than the subject token expires.
  - `issued_token_type` 'urn:ietf:params:oauth:token-type:access_token', required
  - `scope` string, required
  - `token_type` 'Bearer', required

## Other responses

- `400` — Malformed request, unsupported grant, or the subject token was not accepted
- `429` — Rate limited
- `500` — The token could not be issued
- `503` — The issuer’s discovery document or JWKS could not be fetched

## Changes

- **2026-09-03** `5b090958e212` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/openrouterteam/apis/openrouter-api/changes/oauth/token/post.md)

---

[API](https://skmtc.dev/openrouterteam/apis/openrouter-api.md) · [All operations](https://skmtc.dev/openrouterteam/apis/openrouter-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/openrouterteam/openrouter-api/revisions/69fdb8682593/schema)