> This page is for version 0.10.
> For other versions, use one of these documentation indexes:
> - Latest (default): https://docs.nvidia.com/nemo-helix/latest/llms.txt
> - 0.10: https://docs.nvidia.com/nemo-helix/v0.10/llms.txt
> - 0.9: https://docs.nvidia.com/nemo-helix/v0.9/llms.txt
> - 0.8: https://docs.nvidia.com/nemo-helix/v0.8/llms.txt
> - 0.7: https://docs.nvidia.com/nemo-helix/v0.7/llms.txt
> - 0.6: https://docs.nvidia.com/nemo-helix/v0.6/llms.txt
> - 0.5: https://docs.nvidia.com/nemo-helix/v0.5/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemo-helix/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemo-helix/_mcp/server.

# Exchange a workload identity subject token

POST http://localhost:8080/apis/auth/token
Content-Type: application/x-www-form-urlencoded

Exchange a configured workload identity subject token for a NeMo Helix access token.

Reference: https://docs.nvidia.com/nemo-helix/documentation/reference/api-reference/workload-identity/token-exchange-apis-auth-token-post

## Request

### Body (application/x-www-form-urlencoded)

This endpoint expects an object.

- `grant_type` (enum, required) — OAuth 2.0 token exchange grant type.
  - Allowed values: `urn:ietf:params:oauth:grant-type:token-exchange`
- `client_id` (string, required) — Workload token exchange OAuth client ID.
- `subject_token` (string, required) — JWT subject token to exchange.
- `subject_token_type` (enum, required) — Token type identifier for the subject token.
  - Allowed values: `urn:ietf:params:oauth:token-type:jwt`, `urn:nvidia:nemo:params:oauth:token-type:docker-opaque-workload-proof`
- `requested_token_type` (enum, optional, default: urn:ietf:params:oauth:token-type:access_token) — Requested token type identifier for the issued token.
  - Allowed values: `urn:ietf:params:oauth:token-type:access_token`
- `audience` (string, optional) — Requested audience for the issued access token.
- `resource` (string, optional) — Unsupported for the jobs workload token exchange profile.
- `actor_token` (string, optional) — Unsupported for the jobs workload token exchange profile.
- `actor_token_type` (string, optional) — Unsupported for the jobs workload token exchange profile.
- `scope` (string, optional) — Space-separated scopes requested for the issued access token.

## Response

### 200

Successful Response

- `access_token` (string, required) — JWT access token minted for the workload identity.
- `issued_token_type` (string, required) — Token type identifier for the issued token.
- `token_type` (string, required) — OAuth token type used in Authorization headers.
- `expires_in` (integer, required) — Lifetime of the access token in seconds.
- `scope` (string, optional) — Space-separated scopes granted to the access token.

## Errors

### 400 Bad Request Error

RFC 8693 token exchange error

- `error` (string, required) — OAuth 2.0 or RFC 8693 token exchange error code, such as invalid_client, invalid_request, invalid_scope, or invalid_target.
- `error_description` (string, optional) — Human-readable ASCII text providing additional information about the error.
- `error_uri` (string, optional) — URI identifying a human-readable web page with information about the error.

### 401 Unauthorized Error

OAuth 2.0 invalid_client error

- `error` (string, required) — OAuth 2.0 or RFC 8693 token exchange error code, such as invalid_client, invalid_request, invalid_scope, or invalid_target.
- `error_description` (string, optional) — Human-readable ASCII text providing additional information about the error.
- `error_uri` (string, optional) — URI identifying a human-readable web page with information about the error.

## Examples

**Request**

```json
{
  "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
  "client_id": "string",
  "subject_token": "string",
  "subject_token_type": "urn:ietf:params:oauth:token-type:jwt"
}
```

**Response**

```json
{
  "access_token": "string",
  "issued_token_type": "string",
  "token_type": "string",
  "expires_in": 1,
  "scope": "string"
}
```

**SDK Code**

```python
import requests

url = "http://localhost:8080/apis/auth/token"
headers = {"Content-Type": "application/x-www-form-urlencoded"}
payload = "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&client_id=YOUR_CLIENT_ID&subject_token=YOUR_SUBJECT_TOKEN&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Ajwt"

response = requests.request("POST", url, headers=headers, data=payload)
response.raise_for_status()
print(response.json())

```

```javascript
const response = await fetch("http://localhost:8080/apis/auth/token", {
  method: "POST",
  headers: {"Content-Type": "application/x-www-form-urlencoded"},
  body: "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange&client_id=YOUR_CLIENT_ID&subject_token=YOUR_SUBJECT_TOKEN&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Ajwt",
});
if (!response.ok) throw new Error(`HTTP ${response.status}`);
console.log(await response.json());

```