---
title: "RFC 8693 signer session token exchange"
url: "https://livepeer.pymthouse.com/apis/clearinghouse-usage/versions/295ecb35-5fcc-474e-a596-7431f5a1e8aa/paths/api-v1-apps-clientId--oidc-token/post"
---

> Full API specification: https://livepeer.pymthouse.com/apis/clearinghouse-usage/versions/295ecb35-5fcc-474e-a596-7431f5a1e8aa.md

# RFC 8693 signer session token exchange

`POST` `/api/v1/apps/{clientId}/oidc/token`

Exchanges an Auth0 end-user access token (device code / authorization code) or end-user API key (`sk_*`) for a short-lived signer JWT. The `{clientId}` path segment is the public Auth0 app client id. Authenticate with the end-user `subject_token`; optional HTTP Basic with the signer M2M client is supported for server-side callers.

## Path parameters

- `clientId` (string, required) - Public Auth0 client id for the integrator app

## Request body (required)

Content types: `application/x-www-form-urlencoded`

## Responses

- `200` - Signer session
- `400` - Invalid request, grant, target, or unsupported token type
- `401` - Invalid client credentials

## OpenAPI definition

```yaml
openapi: 3.1.0
info:
  title: Clearinghouse Builder API
  version: 1.0.1
servers:
  - url: https://builder-api-production-82bf.up.railway.app
    description: Railway builder-api (Auth0 JWT or sk_*; default until Kong Gateway
      is linked)
  - url: http://localhost:8095
    description: Local builder-api
  - url: ${KONNECT_PROXY_URL}
    description: Kong Gateway proxy (Auth0 JWT / DCR Bearer only; sk_* not accepted
      at the edge)
paths:
  /api/v1/apps/{clientId}/oidc/token:
    post:
      summary: RFC 8693 signer session token exchange
      description: Exchanges an Auth0 end-user access token (device code /
        authorization code) or end-user API key (`sk_*`) for a short-lived
        signer JWT. The `{clientId}` path segment is the public Auth0 app client
        id. Authenticate with the end-user `subject_token`; optional HTTP Basic
        with the signer M2M client is supported for server-side callers.
      parameters:
        - name: clientId
          in: path
          required: true
          schema:
            type: string
          description: Public Auth0 client id for the integrator app
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/TokenExchangeRequest"
      responses:
        "200":
          description: Signer session
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SignerSession"
        "400":
          description: Invalid request, grant, target, or unsupported token type
        "401":
          description: Invalid client credentials
components:
  schemas:
    TokenExchangeRequest:
      type: object
      required:
        - grant_type
        - subject_token
        - subject_token_type
      properties:
        grant_type:
          type: string
          enum:
            - urn:ietf:params:oauth:grant-type:token-exchange
        subject_token:
          type: string
          description: Auth0 user access token (JWT) or end-user API key (sk_*)
        subject_token_type:
          type: string
          enum:
            - urn:ietf:params:oauth:token-type:access_token
        requested_token_type:
          type: string
          enum:
            - urn:ietf:params:oauth:token-type:access_token
        audience:
          type: string
          description: Must match configured signer audience when provided
        resource:
          type: string
          description: Must match configured signer audience when provided
    SignerSession:
      type: object
      required:
        - access_token
        - token_type
        - expires_in
        - scope
        - has_access
        - balance_usd_micros
      properties:
        access_token:
          type: string
        token_type:
          type: string
          enum:
            - Bearer
        expires_in:
          type: integer
        scope:
          type: string
        signer_url:
          type: string
          format: uri
        discovery_url:
          type: string
          format: uri
        issued_token_type:
          type: string
        correlation_id:
          type: string
        has_access:
          type: boolean
          description: Whether the customer currently has allowance. Always present.
        balance_usd_micros:
          type: integer
          format: int64
          description: Allowance balance in USD micros. Always present.
```