Sign in

v1

latestOpenAPI 3.0.32026-07-17183583.3 KB
ApiKeys

Derive Token

Mints a short-lived JWT or Macaroon token from an API key. Works with both issued and imported keys. The derived token inherits the permissions of the parent API key.

POST /v2alpha1/admin/apiKeys:derive
{
  "credential": "eyJhbGciOiJFZERTQSI...",
  "ttl": "1h"
}
post/v2alpha1/admin/apiKeys:derive

Request body

algorithm'TOKEN_ALGORITHM_UNSPECIFIED' | 'TOKEN_ALGORITHM_JWT' | 'TOKEN_ALGORITHM_MACAROON'
  • TOKEN_ALGORITHM_JWT: JWT with EdDSA (self-contained, signed)
  • TOKEN_ALGORITHM_MACAROON: Macaroon with HMAC (self-contained, caveat-based)
credentialstring
custom_claimsobject

custom_claims is a JSON object whose entries are merged into the JWT payload (or macaroon caveats) at signing time. Reserved JWT claims (iss, sub, aud, exp, nbf, iat, jti) are rejected. Total serialized size is capped at 4KB.

scopesstring[]
ttlstring

ttl sets the expiry as a duration from now. Encoded as a google.protobuf.Duration (string ending in "s", e.g. "3600s"). Accepted bounds: 1s to 315360000s (~10 years). If unset or zero, the project default TTL applies. For convenience, the server also accepts Go-style duration strings ("24h", "30m", "1h30m") and an extended unit set ("1d", "1w", "1mo", "1y"; approximations: 1mo = 30d, 1y = 365d). Clients should prefer the standard Duration encoding for portability.

Response

A successful response.