Skip to main content
POST
Get web identity token
Requires the IAM action iam:GetWebIdentityToken. See IAM permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Headers

X-Account-Id
string

Owning account UUID, CRN, or handle. Defaults to the authenticated workload account.

Body

application/json
audience
string
required

Audience expected by the external relying party. Whitespace, control characters and the reserved Basaltic API audience basaltic are rejected. Permission conditions can restrict the allowed audience.

Required string length: 1 - 256
Example:

"sts.amazonaws.com"

duration_seconds
integer
default:300

Lifetime of the identity proof. Omit for 300 seconds. The authenticated session must remain valid for the requested lifetime.

Required range: 60 <= x <= 300

Response

External identity proof issued

token
string
required

Signed ES256 JWT for the requested audience. This proof is a credential; do not log it. It cannot authenticate to Basaltic APIs.

expires_at
string<date-time>
required

Expiration of the identity proof.