Get Token
Exchanges a credential pair (client_id + client_secret) for a signed JWT. The client_id is a credential_id obtained from /internal/credentials/create. Optional expires_in controls the JWT lifetime in seconds (default: 86400 = 24 hours).
Body
Credential ID obtained from /internal/credentials/create.
Client secret paired with the credential.
Logical agent type encoded into the JWT claims. Defaults to "credential" when omitted.
Optional JWT lifetime in seconds (default 86400 = 24 hours).
Response
Token issued.
Signed JWT. Decode the payload to inspect claims: tenant_id, agent_type, scopes (array of "read" | "admin" | "full"), sub, iat, exp, and credential_id identifying the credential used.
