Lexicon Garden

zone.stratos.space.getSpaceCredential

Issue a space credential (JWT) for a space the caller is a member of. The credential is multi-use until it expires and is bound to the caller's DPoP key (cnf.jkt, RFC 9449): it must be presented under the DPoP auth scheme with a per-request proof signed by that key. It is signed by the space authority's signing key so any repo host can verify it without contacting the authority. Identity is resolved from a delegation token when provided (a standalone DPoP proof in the DPoP header supplies the key to bind), otherwise from the DPoP-authenticated user (the session proof key is bound). Membership is checked live against the enrollment store. App-axis (client attestation) gating is enforced here: spaces configured with an app allow-list require a valid client attestation whose attested client_id is listed; spaces that are open ignore any attestation supplied.

Repository @lexicon.northsky.app did:plc:6uxgo3ypovauub7nblwylqyv namespace authority
Details · procedure
Kindprocedure
Authorityspace.stratos.zone
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

clientAttestation

string

Optional client-attestation JWT (an OAuth private_key_jwt client assertion to the space authority). Required only for spaces gated on client app identity (appAccess allowList); the allow-list is evaluated against the attested client_id. Ignored for open spaces.

delegationToken

string

Optional space-delegation JWT. When present, the caller's identity is taken from this token (its target space must equal `space`) instead of the DPoP session.

space

requiredstring

The space's at:// URI (at://{did}/space/{type}/{skey}). Mirrors the upstream space-ref string format (atproto#5187); declared as a plain string until @atproto/lexicon supports that format. Its space DID must equal this service's DID.

Output

application/json

credential

requiredstring

The compact-serialized space-credential JWT.

expiresAt

requiredstring · datetime

The credential's expiry time (matches the JWT `exp` claim).

Errors

InvalidToken

The supplied delegation token failed verification, or its target space does not match the requested space.

NotEnrolled

The identified user is not enrolled in the boundary corresponding to the requested space.

UnknownSpace

The requested space URI is malformed or its space DID does not match this service's DID.

AttestationRequired

The requested space gates on client app identity (appAccess allowList) but no valid client attestation was supplied.

ClientNotAllowed

A valid client attestation was supplied but its attested client_id is not in the space's app allow-list.

ProofRequired

No DPoP key was available to bind the credential to: the delegation path requires a standalone DPoP proof in the DPoP header, and unbound credentials are refused outside development mode.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • social.colibri.beta.actor.grantSpaceAccess

    procedure

    Hands the AppView access to one of the requesting user's personal spaces. The client mints a delegation token on its own PDS for the space and passes it here, because a delegation token is single-use and short-lived and the AppView has no OAuth session of its own. The AppView exchanges the token for a space credential and syncs the space.

  • space.highport.manage.grantSpaceAccess

    procedure

    Give bard a delegation token so it can keep reading a space. Any member can call this with a token they issued. Bard trades it for a credential, renews its notification registration when due, and catches up on anything it missed.

  • space.highport.manage.connectSpace

    procedure

    Connect a space so bard can read and publish the authority's site and tile records from it. Only the authority can call this, with a delegation token it issued. Bard trades the token for a credential, registers for notifications, and pulls the authority's repo. Safe to repeat.