Skip to main content
POST
Exchange a workload OIDC token for a short-lived API key

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

Keys this body does not declare are refused with 422 extra_forbidden naming the accepted keys (since 2026-11-02).

Exchange a workload's OIDC token for a short-lived Mixpeek API key.

provider_id
string
required

The workload identity provider configured on the organization.

Minimum string length: 1
subject_token
string
required

The OIDC token the workload's platform issued: on Vercel, getVercelOidcToken() or the x-vercel-oidc-token header; on GitHub Actions, core.getIDToken(audience).

Minimum string length: 1
ttl_seconds
integer | null

Requested key lifetime. Capped at the provider's token_ttl_seconds and at the subject token's own expiry plus the provider lifetime.

Required range: 60 <= x <= 3600

Response

Successful Response

A short-lived API key. Send it as Authorization: Bearer <access_token>.

access_token
string
required

The API key. Shown once.

expires_in
integer
required

Seconds until the key expires.

expires_at
string<date-time>
required

When the key expires (UTC).

key_id
string
required

Identifier of the minted key, for audit.

organization_id
string
required

Organization the key belongs to.

permissions
enum<string>[]
required

Permissions of the key.

Simplified API key permissions.

This four-value enum replaces the legacy 16-permission model. Keep usage simple: prefer the least privileged option that satisfies the workflow.

Hierarchy (strongest -> weakest): ADMIN > DELETE > WRITE > READ.

Available options:
read,
write,
delete,
admin
token_type
string
default:Bearer
Allowed value: "Bearer"