Mint or rotate a service token

Overview

Mint or rotate a service token. The authentication API establishes identity and manages the roles, grants, sessions, and service credentials used for authorization.

When to use it

• Use it when an application needs to mint or rotate a service token.
• Use it when a client needs to sign in, inspect its identity, or an administrator needs to manage access.

Quick example

Set the base URL and replace generated identifiers or credentials with values from your installation.

curl --request POST \
  --url "$ORDINATE_URL/v1/auth/service-identities/00000000-0000-4000-8000-000000000001/tokens" \
  --header "Authorization: Bearer $ORDINATE_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
    "expires_at_ns": 0
  }'

{
  "token": "string",
  "token_id": "00000000-0000-4000-8000-000000000001",
  "service_id": "00000000-0000-4000-8000-000000000001",
  "issued_at_ns": 0,
  "expires_at_ns": 0
}

The cURL request sends the smallest contract-derived body and asks OrdinateDB to mint or rotate a service token. The documented 201 response is one-time plaintext token; it cannot be retrieved again.

How it works

Reference

Required capability

admin

Authorization scope

handler-resolved target

{
  "expires_at_ns": 0
}

{
  "token": "string",
  "token_id": "00000000-0000-4000-8000-000000000001",
  "service_id": "00000000-0000-4000-8000-000000000001",
  "issued_at_ns": 0,
  "expires_at_ns": 0
}

{
  "error": "string",
  "code": "account-sealed",
  "correlation_id": "00000000-0000-4000-8000-000000000001"
}

{
  "error": "string",
  "code": "account-sealed",
  "correlation_id": "00000000-0000-4000-8000-000000000001"
}

{
  "error": "string",
  "code": "account-sealed",
  "correlation_id": "00000000-0000-4000-8000-000000000001"
}

{
  "error": "string",
  "code": "account-sealed",
  "correlation_id": "00000000-0000-4000-8000-000000000001"
}

{
  "error": "string",
  "code": "account-sealed",
  "correlation_id": "00000000-0000-4000-8000-000000000001"
}

Code examples

These examples are generated from the source contract. Replace the base URL, credentials, identifiers, and minimal generated values for your instance.

const ordinateUrl = "http://localhost:8080";
const token = "<bearer-token>";

const response = await fetch(`${ordinateUrl}/v1/auth/service-identities/00000000-0000-4000-8000-000000000001/tokens`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "expires_at_ns": 0
})
});

if (!response.ok) {
  throw new Error(`OrdinateDB returned ${response.status}: ${await response.text()}`);
}

const data = await response.json();
console.log(data);