A valid request URL is required to generate request examples{
"token": "<string>",
"expires_at": "2023-11-07T05:31:56Z"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Mint a session JWT
Exchanges the opaque uk_ct_… session for a short-lived, signed JWT that your backend can verify offline against the environment’s JWKS document (GET /v1/jwks/{publishableKey}) — no call back to this API on every request.
This is the refresh flow, and there is no second credential to manage: the opaque session is the refresh token. Call again whenever the last JWT is near expiry, for as long as the session lives.
The token lasts 5 minutes, and never past the session that authorized it. That five minutes is the floor of the revocation story rather than the whole of it: a JWT is verified offline, so nothing can recall one, and deleting the session stops only the next refresh. GET /v1/revocations/{publishableKey} is what closes the gap — a cached list your backend already holds, checked alongside the signature, which brings a revoked session down from minutes to seconds. The lifetime stays short because it is the bound that still holds for a verifier that has no list or could not refresh it.
Each mint records the contact against the month’s active-contact meter, idempotently. See GET /v1/organization/usage/active-contacts.
A valid request URL is required to generate request examples{
"token": "<string>",
"expires_at": "2023-11-07T05:31:56Z"
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}