Sign in
OAuth

Exchange a workload identity token

RFC 8693 token exchange. Presents a JWT from an issuer your organization trusts (Settings → Workload identity) and receives a short-lived OpenRouter access token that acts as the API key the matching federation policy targets.

post/oauth/token

Response

Access token issued

access_tokenstring required

A short-lived JWT to send as Authorization: Bearer to the inference API.

expires_ininteger required

Seconds until the access token expires: at most 15 minutes, and never later than the subject token expires.

issued_token_type'urn:ietf:params:oauth:token-type:access_token' required
scopestring required
token_type'Bearer' required

Example response

{
  "access_token": "<short-lived openrouter access token jwt>",
  "expires_in": 900,
  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "scope": "inference",
  "token_type": "Bearer"
}

Changes