---
title: "Oci Token"
method: GET
path: "/v2/token"
---

# Oci Token

`GET /v2/token`

## Request

- Base URL: `https://api-docs.session-exchange.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api-docs.session-exchange.com/v2/token`
- Auth: none declared

Exchange a fleet credential for a registry bearer token.

Docker sends `Authorization: Basic base64(user:password)` here, where the password is the
caller's fleet token. The collector already authenticates Bearer tokens on every other route,
so the "minted" token IS that fleet token echoed back — validated first, never issued blind.

That keeps identity intact: the follow-up /v2 requests carry a real fleet token, so
`require_read_or_emit` resolves the actual producer rather than trusting a claimed username.
No second token type, no HMAC, no key to rotate.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/session-exchange/apis/a4sx.md) · [All operations](https://skmtc.dev/session-exchange/apis/a4sx/llms.txt) · [OpenAPI document](https://skmtc.dev/session-exchange/apis/a4sx/revisions/abaefc33dfc7?raw)