Get a Workload token from the API host
Get a Workload token that the API host signs. The token is valid for 12 hours. Select the grant with grant_type. client_credentials authenticates with a Workload client ID and secret that Spiral issued before it stopped issuing secrets (RFC 6749 §4.4). urn:ietf:params:oauth:grant-type:token-exchange exchanges a JWT from an identity provider for a token of the Workload in principal (RFC 8693 §2.1). Exactly one trust policy of that Workload must match the issuer and claims of the JWT, and Spiral checks the JWT with its issuer. refresh_token is not supported. Errors use the Spiral error body, not the RFC 6749 §5.2 error body. For new integrations, use the token endpoint of the authorization server.
application/x-www-form-urlencoded- body
Authenticate with a Workload client ID and secret. A client assertion is refused: send it to the authorization server instead.
grant_type*unknownclient_id*stringclient_secret*stringThe Workload token.
application/json- response
access_token*stringA JWT whose sub is the Workload ID. It is valid for 12 hours.
token_type*stringexpires_in*nullAlways null.
refresh_token*nullAlways null.
curl -X POST 'https://api.spiraldb.dev/oauth/token' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'grant_type=client_credentials&client_id=string&client_secret=string'{ "access_token": "string", "token_type": "Bearer", "expires_in": null, "refresh_token": null}