Skip to main content
POST
Mint a short-lived signed proof of which org the caller acts for, for one allow-listed Grant consumer.

Authorizations

Authorization
string
header
required

Supabase JWT token in Authorization: Bearer header

Body

application/json
consumer
string
required

The Grant consumer id the proof is bound to (azp); it must be allow-listed.

org_id
string

Org to prove. Omit for the caller's active org. When present it must be one of the caller's ACCEPTED memberships, else 403 not_a_member.

Minimum string length: 1

Response

Signed org proof.

token
string
required

Compact EdDSA JWS.

token_type
any
required
expires_in
integer
required

Seconds.

expires_at
integer
required

Unix seconds.

org_id
string
required