Service token and JWKS API

The recommended TypeScript integration uses @alpha-explora/apicenter-sdk, which obtains and refreshes service tokens for you. Use the endpoints below only when your runtime cannot use that SDK. See Authentication and scopes.

Request a service token

• Endpoint: POST /api/v1/auth/token

Send the registered service ID, environment, and matching service secret:

curl -X POST "$APICENTER_URL/api/v1/auth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "serviceId": "orders-api",
    "environment": "test",
    "secret": "<service-environment-secret>"
  }'

The response contains data.accessToken, the service ID, environment, and the placement resolved from the registry. Use data.accessToken as a bearer token for authorized APICenter routes. Keep the service secret and issued token on the server.

Discover public signing keys

• Endpoint: GET /api/v1/auth/.well-known/jwks.json

The JWKS endpoint returns public keys for verifying APICenter-signed tokens. Follow the token's kid when selecting a key and refresh the key set when an unknown key ID appears. Never use a private signing key in a consumer service.