---
title: "POST /v1/keys.mint"
method: POST
path: "/v1/keys.mint"
tags: ["keys"]
---

# POST /v1/keys.mint

`POST /v1/keys.mint`

Mints a per-customer token (a scoped `am_jwt_` credential) so a downstream / self-hosted app can call Autumn directly without your secret key. Returns a short-lived access token plus a rotating refresh token, both bound to the given customer. Authenticated with your secret key.

## Headers

- `x-api-version` string, required

## Request body

- object
  - `customer_id` string, required — The customer to mint a token for.
  - `indefinite` boolean — If true, mint a non-expiring access token (no refresh token). Revoke via keys.revoke.

## Response `200`

OK

- object
  - `access_token` string, required — Access token (1h, or non-expiring if indefinite), prefixed `am_jwt_`.
  - `refresh_token` string — Rotating refresh token (24h). Omitted for indefinite tokens.
  - `expires_at` number, nullable, required — Access-token expiry, ms since epoch. null for indefinite tokens.
  - `refresh_expires_at` number — Refresh-token expiry, ms since epoch. Omitted for indefinite tokens.

---

[API](https://skmtc.net/useautumn/apis/autumn-api.md) · [All operations](https://skmtc.net/useautumn/apis/autumn-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/useautumn/autumn-api/revisions/29536933c0dc/schema)