Skip to main content
POST
Exchange agent credentials + platform_id for a short-lived JWT

Body

application/json
api_key_id
string
required

Public agent identifier (41 chars, muid_kid_ + 32 hex).

Example:

"muid_kid_a3f8e9c1d2b4f5e6a7b8c9d0e1f2a3b4"

secret
string
required

Agent secret, set at registration / rotation. Never logged.

Example:

"muid_sk_xY9kL2pQ4rT6vN8mZ1cX3bV5nL7kJ9hG"

platform_id
string<uuid>
required

Target platform's UUID.

scopes
string[]

Requested scope subset. Empty array expands to the agent's full permitted set for this platform. All requested scopes must be a subset of what the agent is permitted on this platform.

profile
enum<string>
default:mudraid-native-jwt

Token profile to mint (Phase 1a). Only mudraid-native-jwt exists today; unknown values are rejected with 422. The issued JWT carries the chosen profile as the private claim mudraid_token_profile. The oauth-at-jwt profile is added in Phase 1b.

Available options:
mudraid-native-jwt

Response

JWT issued

access_token
string
required

RS256 JWT. See JwtClaims for the payload shape.

token_type
enum<string>
required
Available options:
Bearer
expires_in
integer
default:900
required

Lifetime in seconds (15 minutes).