Sign in

v1

latestOpenAPI 3.1.02026-07-265817860.8 KB
keys

Mints a per-customer token (a scoped am_jwt_ credential) so a downstream / self-hosted app can call Autumn directly without your secret key. Returns a short-lived access token plus a rotating refresh token, both bound to the given customer. Authenticated with your secret key.

post/v1/keys.mint

Headers

x-api-versionstring required

Request body

customer_idstring required

The customer to mint a token for.

indefiniteboolean

If true, mint a non-expiring access token (no refresh token). Revoke via keys.revoke.

Example request

{
  "customer_id": "cus_123"
}

Response

OK

access_tokenstring required

Access token (1h, or non-expiring if indefinite), prefixed am_jwt_.

refresh_tokenstring

Rotating refresh token (24h). Omitted for indefinite tokens.

expires_atnumber nullable required

Access-token expiry, ms since epoch. null for indefinite tokens.

refresh_expires_atnumber

Refresh-token expiry, ms since epoch. Omitted for indefinite tokens.

Example response

{
  "access_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
  "refresh_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
  "expires_at": 1781113864000,
  "refresh_expires_at": 1781196664000
}