> For the complete documentation index, see [llms.txt](https://docs.otari.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.otari.ai/otari/for-integrators/api-reference/oauth.md).

# Oauth

## Exchange Token

> Exchange an identity token for an access token (the RFC 7523 \`\`jwt-bearer\`\` grant).\
> \
> The identity token must match the federation rule \`\`federation\_rule\_id\`\` names and verify against its issuer:\
> one on \`\`federation\_issuers\`\` for an operator's rule, the one the rule names for a member's. \`\`organization\_id\`\`,\
> where set, must be the UUID of the rule's key's organization. \`\`workspace\_id\`\` and \`\`service\_account\_id\`\` are\
> accepted and ignored, so a client configured for Anthropic needs only its rule and organization changed. The\
> access token authenticates as that key until \`\`expires\_in\`\` runs out, the rule is deleted or the key stops passing\
> its checks.\
> \
> Every refusal of the identity token answers 401 \`\`invalid\_grant\`\` with the same description.

```json
{"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"security":[{"ApiKeyAuth":[]},{"XApiKeyAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"description":"Enter your API key here (sent as Otari-Key header).","in":"header","name":"Otari-Key","type":"apiKey"},"XApiKeyAuth":{"description":"Anthropic-native clients send credentials here (no Bearer prefix).","in":"header","name":"x-api-key","type":"apiKey"}},"schemas":{"FederationTokenRequest":{"description":"An RFC 7523 ``jwt-bearer`` token request, as the Anthropic SDKs and Claude Code send it.\n\nEvery field is optional here so that a missing one is answered in the RFC 6749 error shape rather than as a\nvalidation error. Fields the request does not use are ignored.","properties":{"assertion":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The identity token.","title":"Assertion"},"federation_rule_id":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The id of the federation rule the identity token must match.","title":"Federation Rule Id"},"grant_type":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"urn:ietf:params:oauth:grant-type:jwt-bearer","title":"Grant Type"},"organization_id":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"When set, the UUID of the organization of the rule's key.","title":"Organization Id"},"service_account_id":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Ignored. Accepted so that a client configured for Anthropic's service account id is not refused.","title":"Service Account Id"},"workspace_id":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Ignored. Accepted so that a client configured for Anthropic's workspace id is not refused.","title":"Workspace Id"}},"title":"FederationTokenRequest","type":"object"},"FederationTokenResponse":{"description":"An access token, as RFC 6749 section 5.1 shapes it. Present it as a bearer token in place of the key.","properties":{"access_token":{"title":"Access Token","type":"string"},"expires_in":{"description":"Seconds until the access token expires.","title":"Expires In","type":"integer"},"token_type":{"default":"Bearer","title":"Token Type","type":"string"}},"required":["access_token","expires_in"],"title":"FederationTokenResponse","type":"object"},"OAuthErrorResponse":{"description":"A refused token request, as RFC 6749 section 5.2 shapes it.","properties":{"error":{"description":"invalid_request, unsupported_grant_type, invalid_grant or temporarily_unavailable","title":"Error","type":"string"},"error_description":{"title":"Error Description","type":"string"}},"required":["error","error_description"],"title":"OAuthErrorResponse","type":"object"},"HTTPValidationError":{"properties":{"code":{"const":"invalid_request","description":"Stable error code, also sent as the Otari-Error-Code header.","title":"Code","type":"string"},"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"title":"Detail","type":"array"}},"title":"HTTPValidationError","type":"object"},"ValidationError":{"properties":{"ctx":{"title":"Context","type":"object"},"input":{"title":"Input"},"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"title":"Location","type":"array"},"msg":{"title":"Message","type":"string"},"type":{"title":"Error Type","type":"string"}},"required":["loc","msg","type"],"title":"ValidationError","type":"object"}}},"paths":{"/api/v1/oauth/token":{"post":{"description":"Exchange an identity token for an access token (the RFC 7523 ``jwt-bearer`` grant).\n\nThe identity token must match the federation rule ``federation_rule_id`` names and verify against its issuer:\none on ``federation_issuers`` for an operator's rule, the one the rule names for a member's. ``organization_id``,\nwhere set, must be the UUID of the rule's key's organization. ``workspace_id`` and ``service_account_id`` are\naccepted and ignored, so a client configured for Anthropic needs only its rule and organization changed. The\naccess token authenticates as that key until ``expires_in`` runs out, the rule is deleted or the key stops passing\nits checks.\n\nEvery refusal of the identity token answers 401 ``invalid_grant`` with the same description.","operationId":"oauth-exchange_token","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FederationTokenRequest"}}},"required":true},"responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/FederationTokenResponse"}}},"description":"Successful Response"},"400":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthErrorResponse"}}},"description":"invalid_request or unsupported_grant_type"},"401":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthErrorResponse"}}},"description":"invalid_grant"},"422":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}},"description":"Validation Error"},"503":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OAuthErrorResponse"}}},"description":"temporarily_unavailable"}},"summary":"Exchange Token","tags":["oauth"]}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.otari.ai/otari/for-integrators/api-reference/oauth.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.