---
title: "Exchange an OIDC token for a short-lived service access token"
method: POST
path: "/v1/service/token/exchange"
tags: ["identity"]
---

# Exchange an OIDC token for a short-lived service access token

`POST /v1/service/token/exchange`

## Request

- Base URL: `https://api.runx.ai`
- URL: `https://api.runx.ai/v1/service/token/exchange`
- Auth: none declared

## Request body

- ServiceTokenExchangeRequest (unresolved $ref)

## Response `200`

Issued service access token.

- ServiceTokenExchangeEnvelope
  - `status` 'success', required
  - `access_token` string, required
  - `expires_at` string, date-time, required
  - `principal` PrincipalSummary, required
    - `principal_id` string, required
    - `role` 'user' | 'admin' | 'service', required
    - `display_name` string
    - `scopes` string[]
    - `namespace_prefixes` string[]

## Other responses

- `400`: Validation error.
- `401`: OIDC token not accepted.
- `404`: Service principal not found.
- `503`: Service token exchange unavailable.

---

[API](https://skmtc.dev/runx/apis/runx-hosted-api.md) · [All operations](https://skmtc.dev/runx/apis/runx-hosted-api/llms.txt) · [OpenAPI document](https://skmtc.dev/runx/apis/runx-hosted-api/revisions/6c940d8edacc?raw)