ORory
ApiKeys

Derive Token

Mints a short-lived JWT or Macaroon token from an API key. Works with both issued and imported keys. The derived token inherits the permissions of the parent API key.

POST /v2alpha1/admin/apiKeys:derive
{
  "credential": "eyJhbGciOiJFZERTQSI...",
  "ttl": "1h"
}
post/v2alpha1/admin/apiKeys:derive

Request

  • Base URL
    https://your-project.projects.oryapis.com
  • URL
    https://your-project.projects.oryapis.com/v2alpha1/admin/apiKeys:derive
  • Auth
    none declared

Request body

algorithm'TOKEN_ALGORITHM_UNSPECIFIED' | 'TOKEN_ALGORITHM_JWT' | 'TOKEN_ALGORITHM_MACAROON'
  • TOKEN_ALGORITHM_JWT: JWT with EdDSA (self-contained, signed)
  • TOKEN_ALGORITHM_MACAROON: Macaroon with HMAC (self-contained, caveat-based)
credentialstring
custom_claimsobject

custom_claims is a JSON object whose entries are merged into the JWT payload (or macaroon caveats) at signing time. Reserved JWT claims (iss, sub, aud, exp, nbf, iat, jti) are rejected. Total serialized size is capped at 4KB.

scopesstring[]
ttlstring

ttl sets the expiry as a duration from now. Encoded as a google.protobuf.Duration (string ending in "s", e.g. "3600s"). Accepted bounds: 1s to 315360000s (~10 years). If unset or zero, the project default TTL applies. For convenience, the server also accepts Go-style duration strings ("24h", "30m", "1h30m") and an extended unit set ("1d", "1w", "1mo", "1y"; approximations: 1mo = 30d, 1y = 365d). Clients should prefer the standard Duration encoding for portability.

Response

A successful response.

Changes

No recorded changes to this operation across all 1 revision of this API.