Exchange a workload identity token for an access token

Workload identity federation. Send the JWT your identity provider (Okta, Entra ID, GitHub Actions, a cloud workload identity pool, …) issued to your workload; if a trusted identity provider configured under Configuration → API Access matches its issuer and audience and its subject/claims pass that provider's rules, you receive a short-lived wxs_ft_… bearer token carrying that provider's permissions. Use it like an API key until it expires, then exchange a new JWT. Nothing secret needs to be stored on your side.

Request body (optional)

grant_typeenumrequired

urn:ietf:params:oauth:grant-type:token-exchange

subject_tokenstringrequired

The identity provider's JWT

subject_token_typeenum

urn:ietf:params:oauth:token-type:jwt

scopestring

Space-separated permission names to narrow the token to

Responses

200A short-lived access token

access_tokenstringrequired

issued_token_typestringrequired

token_typeenumrequired

Bearer

expires_innumberrequired

scopestringrequired

400Malformed request

401Token not accepted by any trusted identity provider

Sending requests from a browser

Open https://v3.revolutionstreetwxs.io/api/v3/docs to send requests to this endpoint with your API key.

Request

curl -X POST 'https://v3.revolutionstreetwxs.io/api/v3/auth/token' \
  -H "Authorization: Bearer wxs_pk_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
  "subject_token": "subject_token",
  "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
  "scope": "orders:ListOrders data_ops:ListDatasets"
}'

const response = await fetch("https://v3.revolutionstreetwxs.io/api/v3/auth/token", {
  method: "POST",
  headers: {
    Authorization: "Bearer wxs_pk_YOUR_API_KEY",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
    "subject_token": "subject_token",
    "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
    "scope": "orders:ListOrders data_ops:ListDatasets"
  }),
});
const data = await response.json();

import requests

response = requests.post(
    "https://v3.revolutionstreetwxs.io/api/v3/auth/token",
    headers={"Authorization": "Bearer wxs_pk_YOUR_API_KEY"},
    json={
      "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
      "subject_token": "subject_token",
      "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
      "scope": "orders:ListOrders data_ops:ListDatasets"
    },
)
data = response.json()

Response 200

{
  "access_token": "access_token",
  "issued_token_type": "issued_token_type",
  "token_type": "Bearer",
  "expires_in": 1.5,
  "scope": "scope"
}