v1

latestOpenAPI 3.0.0Apache 2.02026-07-26322141.0 KB

API Gateway

Token Exchange

Exchange an OIDC id_token issued by a configured external provider for a nominative Prisme access token, without any browser redirect. Intended for native/mobile or headless clients that already authenticated against their IdP. Loosely follows RFC 8693. The target provider must have config.allowTokenExchange = true. The subject_token signature is verified against the provider JWKS and its aud claim must match the provider client_id (and iss the configured issuer when set). The user is then matched or provisioned exactly like the browser callback (POST /v2/login/callback).

post/v2/login/token-exchange

Request body

providerstring required

Slug of the configured external auth provider.

subject_tokenstring required

The id_token (JWT) issued by the external provider.

subject_token_typestring

Token type, per RFC 8693. Only urn:ietf:params:oauth:token-type:id_token is supported.

grant_typestring

Optional, for RFC 8693 compatibility. When provided must be urn:ietf:params:oauth:grant-type:token-exchange.

expiresAfternumber

Optional session expiration in seconds

Response

Success Response

emailstring

status'pending' | 'validated' | 'deactivated'

languagestring

mfa'totp' | 'none' | '*'

metaobject

orgSlugsstring[]

platformRolestring

groupAclsobject

createdAtstring

updatedAtstring

updatedBystring

firstNamestring required

Name

lastNamestring

Name

photostring

Profile picture URL

groupsstring[]

idstring

Unique id

sessionIdstring required

expiresstring

Example response

{
  "email": "foo@prisme.ai"
}