Typescript (SDK)
import { Autumn } from 'autumn-js'
const autumn = new Autumn()
const result = await autumn.keys.mint({
customerId: "cus_123",
});{
"access_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
"refresh_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
"expires_at": 1781113864000,
"refresh_expires_at": 1781196664000
}
Authorization
Mint
Mints a per-customer token (a scoped am_jwt_ credential) so a downstream / self-hosted app can call Autumn directly without your secret key. Returns a short-lived access token plus a rotating refresh token, both bound to the given customer. Authenticated with your secret key.
POST
/
v1
/
keys.mint
Typescript (SDK)
import { Autumn } from 'autumn-js'
const autumn = new Autumn()
const result = await autumn.keys.mint({
customerId: "cus_123",
});{
"access_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
"refresh_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
"expires_at": 1781113864000,
"refresh_expires_at": 1781196664000
}
Mints a per-customer token — a scoped
am_jwt_ credential — so a self-hosted or downstream app can call Autumn directly without your secret key. Authenticated with your secret key. Returns a short-lived access token (1h) and a rotating refresh token (24h), both bound to a single customer.How it works
- Your backend calls
keys.mintwith your secret key to issue a token pair for a customer. - Hand the access token to that customer’s app. It can call
check,track,customers.getandentities.get— always scoped to that customer, even if a differentcustomer_idis sent. - Before the access token expires, the app calls
keys.refreshwith its refresh token to rotate a fresh pair — no secret key required.
const { accessToken, refreshToken } = await autumn.keys.mint({
customerId: "cus_123",
});
Body Parameters
Response
{
"access_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
"refresh_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
"expires_at": 1781113864000,
"refresh_expires_at": 1781196664000
}
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Body
application/json
Response
200 - application/json
OK
Access token (1h, or non-expiring if indefinite), prefixed am_jwt_.
Access-token expiry, ms since epoch. null for indefinite tokens.
Rotating refresh token (24h). Omitted for indefinite tokens.
Refresh-token expiry, ms since epoch. Omitted for indefinite tokens.
⌘I