Skip to main content
POST
Exchange API key for tokens
Exchange your API key for an access token and refresh token. This is the HTTP version of what the SDK does on first use. See Authentication for the full flow. Call this directly only when you are not using the Python SDK, or when another service brokers tokens for your app.

Body

string
required
Your API key.

Response — 200

string
RS256-signed JWT. Send as Authorization: Bearer <access_token> on subsequent calls. Lifetime: 24h.
string
Refresh JWT. Use to obtain a new access token without re-exchanging the API key. Lifetime: 7d.
string
Always "bearer".
number
Access-token lifetime in seconds.

Example

Response

JWT contents

Decode the access token if you want to inspect its claims. If you need to trust those claims, verify the token with the JWKS endpoint.
The org_id and user_id claims are what server-side scoping reads. They cannot be overridden by request bodies.