Token Exchange Endpoint

Exchange a signed JWT assertion for a platform access token.

Endpoint

POST https://prod.rynopay.io/auth/partner/v1/token

Request body

Field	Type	Required	Description
grantType	string	Yes	Must be urn:ietf:params:oauth:grant-type:jwt-bearer
assertion	string	Yes	ECDSA-signed JWT assertion
scope	string	No	Space-separated scope list. Defaults to all granted scopes

Example request

curl -X POST https://prod.rynopay.io/auth/partner/v1/token \
  -H "Content-Type: application/json" \
  -d '{
    "grantType": "urn:ietf:params:oauth:grant-type:jwt-bearer",
    "assertion": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1...",
    "scope": "partner.read partner.write"
  }'

Response

200 OK

{
  "accessToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...",
  "tokenType": "Bearer",
  "expiresIn": 3600,
  "scope": "partner.read partner.write"
}

Field	Type	Description
accessToken	string	Platform-signed JWT access token
tokenType	string	Always Bearer
expiresIn	integer	Token lifetime in seconds
scope	string	Space-separated list of granted scopes

400 Bad Request

{
  "isSuccess": false,
  "error": {
    "code": "TokenExchange.InvalidSignature",
    "message": "JWT assertion signature validation failed"
  }
}

See Error Reference for all error codes.

JWT assertion requirements

The assertion field must be a valid JWT with:

Header

{
  "alg": "ES256",
  "typ": "JWT",
  "kid": "<api-key-id>"
}

Payload

{
  "iss": "<partner-id>",
  "sub": "<partner-id>",
  "aud": "https://prod.rynopay.io/auth/partner/v1/token",
  "iat": 1700000000,
  "exp": 1700000300,
  "jti": "<unique-id>"
}

Validation rules

Rule	Requirement
Algorithm	ES256
kid	Must be a valid UUID matching a registered API key
iss	Must be the Partner ID associated with the API key
sub	Must equal iss
aud	Must be https://prod.rynopay.io/auth/partner/v1/token
exp - iat	Must not exceed 300 seconds (5 minutes)
jti	Must be unique (replay prevention via server-side cache)
Signature	Must be valid against the registered public key
API key	Must not be expired
Partner account	Must be active