Auth
Management plane, central-only (needs the identity tables). The guard is
require_user_or_org_key; this route is deliberately NOT in
orgs::ORG_KEY_ROUTES, so an org-key caller never reaches it (no
UserCtx ⇒ 401) — a machine credential has no user identity to mint.
oidc_jwtAuthorizationBearer <token>The signed-in user's OIDC access token — the management-plane credential. On this surface it is accepted only by POST /auth/token.
RFC 8693 token-exchange request, as JSON or the RFC's native form encoding. audience selects the token kind: omitted or daytona:api mints a project-scoped workload token (project_id required, org_id omitted); daytona:analytics mints an org-scoped rlp-analytics token (org_id required, project_id omitted). Any other audience is refused, and audience, org_id, and project_id may not be repeated. scope and resource must be omitted because down-scoping is not supported.
- body
RFC 8693 §2.1 token-exchange request. Accepted as JSON or as
application/x-www-form-urlencoded (the RFC's native encoding).
The audience parameter selects the token kind
(PLAN-ANALYTICS-PLATFORM-TOKENS.md D1): absent or daytona:api mints the
project-scoped workload token and needs project_id; daytona:analytics
mints the org-scoped rlp-analytics token and needs org_id. Exactly one
of project_id/org_id is accepted, the one the audience calls for.
audience, org_id, and project_id may not be repeated (RFC 8693 lets
a client repeat audience; this exchange does not): a repeated parameter
is a 400 in either encoding.
audience?|RFC 8693 target audience — selects the token kind. Omit it, or send
daytona:api, for the project-scoped workload token; send
daytona:analytics for the org-scoped rlp-analytics token. Any other
value is refused; the parameter may not be repeated.
grant_type*stringMust be urn:ietf:params:oauth:grant-type:token-exchange.
org_id?|The organization the analytics token is scoped to. Required when
audience is daytona:analytics; omitted (or null) otherwise.
uuidproject_id?|The project the workload token is scoped to (one exchange per
(user, project)). Required when audience is absent or daytona:api;
omitted (or null) when audience is daytona:analytics.
uuidresource?|RFC 8693 target resource. Explicit down-scoping is not supported; omit this parameter.
scope?|RFC 8693 scope request. Explicit down-scoping is not supported; omit this parameter.
subject_token*stringThe caller's OIDC JWT. MUST be byte-identical to the Authorization bearer this request authenticated with — the minted identity comes only from the verified bearer, never from an unverified body field.
subject_token_type*stringurn:ietf:params:oauth:token-type:access_token or
urn:ietf:params:oauth:token-type:jwt.
Token minted for the caller's effective permissions in the project (workload audience) or the organization (analytics audience)
application/json- response
RFC 8693 §2.2.1 success response.
access_token*stringThe platform token (RFC 9068 at+jwt, ES256): project-scoped with
aud: daytona:api, or org-scoped with aud: daytona:analytics.
expires_in*integerToken lifetime in seconds (default 300).
int640 <= valueissued_token_type*stringAlways urn:ietf:params:oauth:token-type:access_token.
token_type*stringAlways Bearer.
curl -X POST 'https://example.com/auth/token' \ -H 'Content-Type: application/json' \ -d '{ "grant_type": "string", "subject_token": "string", "subject_token_type": "string"}'{ "access_token": "string", "expires_in": 0, "issued_token_type": "string", "token_type": "string"}