Skip to content

Issue Service Token

POST
/service-token

PREVIEW. This endpoint is deployed but gated: it returns 404 unless the hosted app platform is enabled for your organization. It is published here so the contract describes the whole surface, not so it can be called today.

Mint a service (client-credentials) app token bound to the credential’s org.

A fail-closed per-credential limiter throttles the mint (429) before the credential is even checked, so brute-forcing a client secret is rate-bound.

Authorizations

Request Body required

Client-credentials exchange for a service (server-to-server) app token.

object
client_id
required

Service credential client id

string
client_secret
required

Service credential client secret (checked against stored hash)

string
scopes

Scopes to embed in the token

Array<string>
ttl_seconds
Any of:
integer

Responses

200

Successful Response

object
data
required

The minted token + the non-secret metadata a client needs.

object
access_token
required

The signed app JWT

string
app_id
required

App the token is bound to

string
audience
required

The distinct-per-app, per-environment audience

string
expires_in
required

Lifetime in seconds

integer
kid
required

Signing key id (matches a JWKS entry)

string
token_type

Always ‘Bearer’

string
default: Bearer
pagination
Any of:
object
has_next
required

Whether there are more pages

boolean
limit
required

Items per page

integer
next_cursor
Any of:
string
page
required

Current page number (1-indexed)

integer
total
required

Total number of items

integer

422

Validation Error

object
detail
Array<object>
object
loc
required
Array
msg
required
string
type
required
string