Exchange API key for tokens
curl --request POST \
--url https://api.getmetacognition.com/auth/token-exchange \
--header 'Content-Type: application/json' \
--data '
{
"api_key": "<string>"
}
'import requests
url = "https://api.getmetacognition.com/auth/token-exchange"
payload = { "api_key": "<string>" }
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({api_key: '<string>'})
};
fetch('https://api.getmetacognition.com/auth/token-exchange', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.getmetacognition.com/auth/token-exchange",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'api_key' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.getmetacognition.com/auth/token-exchange"
payload := strings.NewReader("{\n \"api_key\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.getmetacognition.com/auth/token-exchange")
.header("Content-Type", "application/json")
.body("{\n \"api_key\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.getmetacognition.com/auth/token-exchange")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"api_key\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"access_token": "<string>",
"refresh_token": "<string>",
"token_type": "<string>",
"expires_in": 123
}Auth & sessions
Exchange API key for tokens
Exchange an API key for short-lived access and refresh JWTs.
POST
/
auth
/
token-exchange
Exchange API key for tokens
curl --request POST \
--url https://api.getmetacognition.com/auth/token-exchange \
--header 'Content-Type: application/json' \
--data '
{
"api_key": "<string>"
}
'import requests
url = "https://api.getmetacognition.com/auth/token-exchange"
payload = { "api_key": "<string>" }
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({api_key: '<string>'})
};
fetch('https://api.getmetacognition.com/auth/token-exchange', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.getmetacognition.com/auth/token-exchange",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'api_key' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.getmetacognition.com/auth/token-exchange"
payload := strings.NewReader("{\n \"api_key\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.getmetacognition.com/auth/token-exchange")
.header("Content-Type", "application/json")
.body("{\n \"api_key\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.getmetacognition.com/auth/token-exchange")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"api_key\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"access_token": "<string>",
"refresh_token": "<string>",
"token_type": "<string>",
"expires_in": 123
}Exchange your API key for an access token and refresh token. This is the HTTP version of what the SDK does on first use. See Authentication for the full flow.
Call this directly only when you are not using the Python SDK, or when another service brokers tokens for your app.
Response —
The
Body
{
"api_key": "tex_live_..."
}
string
required
Your API key.
Response — 200
string
RS256-signed JWT. Send as
Authorization: Bearer <access_token> on subsequent calls. Lifetime: 24h.string
Refresh JWT. Use to obtain a new access token without re-exchanging the API key. Lifetime: 7d.
string
Always
"bearer".number
Access-token lifetime in seconds.
Example
curl -X POST https://api.getmetacognition.com/auth/token-exchange \
-H 'content-type: application/json' \
-d '{"api_key":"tex_live_..."}'
import httpx
resp = httpx.post(
"https://api.getmetacognition.com/auth/token-exchange",
json={"api_key": "tex_live_..."},
)
tokens = resp.json()
access = tokens["access_token"]
const resp = await fetch(
"https://api.getmetacognition.com/auth/token-exchange",
{
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({ api_key: "tex_live_..." }),
}
);
const tokens = await resp.json();
Response
{
"access_token": "eyJhbGciOiJSUzI1NiIs...",
"refresh_token": "eyJhbGciOiJSUzI1NiIs...",
"token_type": "bearer",
"expires_in": 86400
}
JWT contents
Decode the access token if you want to inspect its claims. If you need to trust those claims, verify the token with the JWKS endpoint.{
"org_id": "org_79d0fHwDRhoZ8Ww7",
"user_id": "apikey_a1247653",
"roles": ["*"],
"exp": 1778147808,
"iat": 1778061408,
"type": "access"
}
org_id and user_id claims are what server-side scoping reads. They cannot be overridden by request bodies.