Exchange API key for a JWT token
Exchange an API key for a JWT token
Authorizations
Gateway auth: send Authorization: Bearer <mka1-api-key>. For multi-user server-side integrations, you can also send X-On-Behalf-Of: <external-user-id>.
Headers
Optional external end-user identifier forwarded by the API gateway.
Body
JWT audience (aud) claim for the exchanged token. Set this to the target API/service URL that should accept the token.
2048Your external user identifier to place in the JWT subject (sub) claim. Must be 1–150 printable-ASCII characters and not the wildcard *.
1 - 150^[\x20-\x7E]+$Token lifetime in seconds. Must be between 300 (5 minutes) and 2592000 (30 days). Defaults to 3600 (1 hour).
300 <= x <= 2592000Optional subset of the API key's scopes to embed in the token (e.g. read:responses). The exchanged token is attenuated to this set at the gateway perimeter. If omitted, all of the key's scopes are embedded (no attenuation).
Response
Successfully exchanged API key for a JWT token
Signed JWT exchange token to use when calling downstream services.