Exchange a signed assertion for a bearer token, without sending a password.
Sign a short-lived JWT assertion with the private key whose public half you registered with Jiko, and post it here. You receive the same bearer token /api/v1/login/ returns, and use it the same way.
This is an OAuth token endpoint (RFC 6749, RFC 7523): post application/x-www-form-urlencoded with grant_type set to urn:ietf:params:oauth:grant-type:jwt-bearer and assertion set to the signed JWT. The response carries access_token, token_type (always Bearer), and expires_in in seconds.
Failures return 400 with the RFC 6749 §5.2 body — {"error", "error_description"} — rather than this API's usual error shape: invalid_request if grant_type or assertion is missing, unsupported_grant_type for any other grant, and invalid_grant if the assertion itself was rejected.
The assertion must be signed with EdDSA (Ed25519) or ES256 (NIST P-256), carry your key's kid in the header, and contain these claims:
| Claim | Value |
|---|---|
iss | your API username |
sub | your API username (same as iss) |
aud | the audience Jiko issued you with your key |
exp | no more than 5 minutes ahead — 60 seconds is recommended |
iat | the time you signed it |
jti | a unique id; an assertion may be exchanged only once |
Request signing still applies to every other endpoint: this replaces your password, not your shared secret.
See Authentication.
- Sandbox serverhttps://your-partner-name.sandbox-api.jikoservices.com/token/
- Production serverhttps://your-partner-name.partner-api.jikoservices.com/token/
curl -i -X POST \
https://your-partner-name.sandbox-api.jikoservices.com/token/ \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d grant_type=string \
-d assertion=string// No response example