---
title: "Exchange Signed Challenge for JWT"
method: POST
path: "/auth/token"
tags: ["Authentication"]
---

# Exchange Signed Challenge for JWT

`POST /auth/token`

Authenticate an agent by verifying a signed nonce and return a JWT access token
with embedded permissions and resource scopes.

## Request body

- TokenRequest
  - `agent_id` string, required
  - `nonce` string, required
  - `signature` string, base64, required — Base64-encoded Ed25519 signature of the nonce

## Response `200`

JWT token issued successfully

- Token
  - `access_token` string — JWT access token with embedded agent permissions
  - `token_type` string

## Other responses

- `400` — Invalid or expired nonce
- `401` — Invalid signature or authentication failed
- `404` — Agent not found
- `500` — Internal Server Error - Unexpected server error

---

[API](https://skmtc.net/deeptrail/apis/deepsecure-api-dual-service-architecture.md) · [All operations](https://skmtc.net/deeptrail/apis/deepsecure-api-dual-service-architecture/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/deeptrail/deepsecure-api-dual-service-architecture/revisions/78627360c082/schema)