Lexicon Garden

com.atproto.server.getServiceAuth

Get a signed token on behalf of the requesting DID for the requested service.

Repository @atproto-lexicons.bsky.social did:plc:6msi3pj7krzih5qxqtryxlzw namespace authority
Details · query
Kindquery
Authorityserver.atproto.com
Indexed
Compare Edit in builder → Fork →

Query

query · GET

Parameters

query string

aud

requiredstring

The DID or `did#serviceId` reference of the service that the token will be used to authenticate with.

  • maxLength: 2048

exp

integer

The time in Unix Epoch seconds that the JWT expires. Defaults to 60 seconds in the future. The service may enforce certain time bounds on tokens depending on the requested scope.

lxm

string · nsid

Lexicon (XRPC) method to bind the requested token to

Output

application/json

token

requiredstring

Errors

BadExpiration

Indicates that the requested expiration date is not a valid. May be in the past or may be reliant on the requested scopes.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • org.tangled.repo.mintToken

    procedure

    Mint a service-auth JWT whose issuer is this repo's DID, signed by the knot that owns the repo's signing key. When calling this, you'll need the same perms as git push, ie. being repo owner/collaborator/knot-admin.

  • at.blueharbor.createSession

    procedure

    The lxm named in service-auth JWTs minted for the BlueHarbor backend (aud did:web:blueharbor.at). The backend verifies the JWT against the caller's DID document and exchanges it for a BlueHarbor session token. Defined here so the method identifier resolves; the HTTP call itself is served by the BlueHarbor service, not a PDS.

  • app.didpic.identity.getFastPathToken

    procedure

    Exchange a proxied service-auth call for a short-lived direct-access token bound to the viewer's DID.