keys

POST /v1/keys.mint

Mints a per-customer token (a scoped am_jwt_ credential) so a downstream / self-hosted app can call Autumn directly without your secret key. Returns a short-lived access token plus a rotating refresh token, both bound to the given customer. Authenticated with your secret key.

Request

Base URL
https://api.useautumn.com
Auth
HTTP bearer
TypeScript
https://skmtc.dev/useautumn/apis/autumn-api/docs/v1/keys.mint/post.ts
A function with typed inputs. Its response is checked against the schema.

Headers

x-api-versionstring required

Request body

customer_idstring required

The customer to mint a token for.

indefiniteboolean

If true, mint a non-expiring access token (no refresh token). Revoke via keys.revoke.

Example request

{
  "customer_id": "cus_123"
}

Response

access_tokenstring required

Access token (1h, or non-expiring if indefinite), prefixed am_jwt_.

refresh_tokenstring

Rotating refresh token (24h). Omitted for indefinite tokens.

expires_atnumber nullable required

Access-token expiry, ms since epoch. null for indefinite tokens.

refresh_expires_atnumber

Refresh-token expiry, ms since epoch. Omitted for indefinite tokens.

Example response

{
  "access_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
  "refresh_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
  "expires_at": 1781113864000,
  "refresh_expires_at": 1781196664000
}

Changes

No recorded changes to this operation across all 1 revision of this API.