Tokens

Use tokens to facilitate authentication to the NVIDIA Run:ai API. The API server must be configured to use the NVIDIA Run:ai identity service to validate authentication tokens.

Deprecated

Create an access token v1

post

Create tokens using the grant_type parameter. This endpoint is deprecated. Use /api/v2/token instead.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication

Body

application/json

grantTypeundefined · enumOptionalPossible values:

appIDstring · max: 255OptionalDeprecated

appSecretstring · max: 500OptionalDeprecated

codestring · max: 2048Optional

redirectUristring · max: 2048Optional

refreshTokenstring · max: 4096Optional

usernamestring · max: 255Optional

passwordstring · max: 255Optional

clientIDstring · max: 255Optional

clientSecretstring · max: 500Optional

externalTokenstring · max: 4096Optional

Responses

200

Executed successfully.

application/json

accessTokenstringOptional

idTokenstringOptional

refreshTokenstringOptional

expiresInintegerOptional

Token lifetime in seconds

400

Bad request.

application/json

500

unexpected error

application/json

503

unexpected error

application/json

post

/api/v1/token

HTTPcURLJavaScriptPython

POST /api/v1/token HTTP/1.1
Host: app.run.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 86

{
  "grantType": "client_credentials",
  "clientID": "clientID",
  "clientSecret": "clientSecret"
}

client_credentialsrefresh_tokenexchange_tokenexternal_token_exchangeapp_token (deprecated)

{
  "accessToken": "text",
  "idToken": "text",
  "refreshToken": "text",
  "expiresIn": 1
}

Create an access token v2

post

Use this endpoint to obtain an access token. Compliant with standard OAuth2 protocol and supports the common OAuth2 grant types.

Authorizations

bearerAuth

AuthorizationstringRequired

Bearer authentication

Body

application/x-www-form-urlencoded

grant_typestring · enumRequired

The OAuth2 grant type. Determines the authentication flow and which parameters are required:

client_credentials - Authenticate as a service account or user access key using clientId and clientSecret.

password - Authenticate as a local user using username and password.

external_token_exchange - Authenticate as a service account or user using a token issued by the configured identity provider (IdP) for a Run:ai token. Requires externalToken.

Possible values:

client_idstringOptional

The client identifier for a service account or user access key. Required when using the client_credentials grant type. Must be used together with clientSecret.

client_secretstring · passwordOptional

The client secret corresponding to the clientId. Required when using the client_credentials grant type. Must be used together with clientId.

usernamestringOptional

The username of a local user account. Required when using the password grant type. Must be used together with password.

passwordstring · passwordOptional

The password for the specified username. Required when using the password grant type. Must be used together with username.

external_tokenstringOptional

A valid token issued by the identity provider (IdP) that is configured in NVIDIA Run:ai. Required when using the external_token_exchange grant type.

Responses

200

Successfully issued token

application/json

access_tokenstringRequired

The access token issued by the authorization server

token_typestringRequired

The type of the token issued (typically "Bearer")

Example: Bearer

expires_inintegerOptional

The lifetime in seconds of the access token

Example: 3600

refresh_tokenstringOptional

The refresh token, which can be used to obtain new access tokens

id_tokenstringOptional

ID Token value associated with the authenticated session (OpenID Connect)

scopestringOptional

The scope of the access token

400

Invalid request

application/json

401

Client authentication failed

application/json

500

unexpected error

application/json

503

unexpected error

application/json

post

/api/v2/token

HTTPcURLJavaScriptPython

POST /api/v2/token HTTP/1.1
Host: app.run.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 97

"grant_type='client_credentials'&client_id='my-client-id'&client_secret='my-client-secret'"

client_credentialspasswordexternal_token_exchange

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}