Skip to navigation
Auth

Obtain a short-lived access token for authenticated endpoints

Exchanges a signed JWT assertion for a short-lived access token, using the RFC 7523 JWT-bearer grant. To call this, sign an assertion with the private key of a key pair whose public key was registered for your store when your integration was set up (credentials are issued during that setup, not obtained here). Send the returned token as Authorization: Bearer <token> on endpoints that require it; it expires quickly, so request a fresh one as needed rather than caching it long-term.

Headers

x-entriastringRequired

Identifies which store this request is for. Required on every store-scoped route. It is not authentication and not a secret — it grants no privileges and is safe to send from a browser. You receive the value once your Entria backend has been created and configured. Missing header returns 400; an unknown store returns 404.

Request

This endpoint expects an object.
grant_typeenumRequired

Must be the RFC 7523 JWT-bearer grant type string.

Allowed values:
assertionstringRequired

A short-lived JWT signed with your private key, identifying your registered client and this store.

Response

Access token issued
access_tokenstring
The bearer token to use on authenticated requests.
token_typeenum
Allowed values:
expires_indouble

Seconds until the access token expires; request a new one after this.

Errors

400
Bad Request Error
401
Unauthorized Error