> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useautumn.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mint

> Mints a per-customer token (a scoped `am_jwt_` credential) so a downstream / self-hosted app can call Autumn directly without your secret key. Returns a short-lived access token plus a rotating refresh token, both bound to the given customer. Authenticated with your secret key.

export const DynamicResponseExample = ({json, statusCode = "200"}) => {
  const toCamelCase = str => {
    return str.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
  };
  const convertKeysToCamelCase = obj => {
    if (Array.isArray(obj)) {
      return obj.map(item => convertKeysToCamelCase(item));
    }
    if (obj !== null && typeof obj === "object") {
      return Object.keys(obj).reduce((acc, key) => {
        const camelKey = toCamelCase(key);
        acc[camelKey] = convertKeysToCamelCase(obj[key]);
        return acc;
      }, {});
    }
    return obj;
  };
  const [isTypeScript, setIsTypeScript] = useState(() => {
    if (typeof window !== "undefined") {
      try {
        const lang = localStorage.getItem("code");
        return JSON.parse(lang) === "typescript";
      } catch {
        return true;
      }
    }
    return true;
  });
  useEffect(() => {
    const onMintlifyStorage = event => {
      if (event.detail?.key === "code") {
        try {
          const value = JSON.parse(event.detail.value);
          setIsTypeScript(value === "typescript");
        } catch {}
      }
    };
    const pollInterval = setInterval(() => {
      try {
        const lang = localStorage.getItem("code");
        const value = JSON.parse(lang);
        setIsTypeScript(value === "typescript");
      } catch {}
    }, 300);
    document.addEventListener("mintlify-localstorage", onMintlifyStorage);
    return () => {
      document.removeEventListener("mintlify-localstorage", onMintlifyStorage);
      clearInterval(pollInterval);
    };
  }, []);
  const camelCaseJson = useMemo(() => convertKeysToCamelCase(json), [json]);
  const snakeCaseString = JSON.stringify(json, null, 2);
  const camelCaseString = JSON.stringify(camelCaseJson, null, 2);
  return <ResponseExample>
			{isTypeScript ? <CodeBlock language="json" filename={statusCode}>
					{camelCaseString}
				</CodeBlock> : <CodeBlock language="json" filename={statusCode}>
					{snakeCaseString}
				</CodeBlock>}
		</ResponseExample>;
};

export const DynamicResponseField = ({children, name, ...props}) => {
  const convertToCamelCase = str => {
    if (typeof str !== "string") return str;
    return str.replace(/[_-](\w)/g, (_, c) => c.toUpperCase());
  };
  const [lang, setLang] = useState(() => {
    if (typeof window !== "undefined") {
      const stored = localStorage.getItem("code");
      return stored || '"typescript"';
    }
    return '"typescript"';
  });
  useEffect(() => {
    const onMintlifyStorage = event => {
      const key = event.detail?.key;
      if (key === "code") {
        setLang(event.detail.value);
      }
    };
    const pollInterval = setInterval(() => {
      const current = localStorage.getItem("code");
      if (current && current !== lang) {
        setLang(current);
      }
    }, 500);
    document.addEventListener("mintlify-localstorage", onMintlifyStorage);
    return () => {
      document.removeEventListener("mintlify-localstorage", onMintlifyStorage);
      clearInterval(pollInterval);
    };
  }, [lang]);
  const resolvedName = useMemo(() => {
    try {
      const value = JSON.parse(lang);
      const useCamelCase = value === "typescript";
      return useCamelCase ? convertToCamelCase(name) : name;
    } catch {
      return name;
    }
  }, [name, lang]);
  return <ResponseField name={resolvedName} {...props}>
			{children}
		</ResponseField>;
};

export const DynamicParamField = ({children, body, path, ...props}) => {
  const convertToCamelCase = str => {
    if (typeof str !== "string") return str;
    return str.replace(/[_-](\w)/g, (_, c) => c.toUpperCase());
  };
  const [lang, setLang] = useState(() => {
    if (typeof window !== "undefined") {
      const stored = localStorage.getItem("code");
      return stored || '"typescript"';
    }
    return '"typescript"';
  });
  useEffect(() => {
    const onMintlifyStorage = event => {
      const key = event.detail?.key;
      if (key === "code") {
        setLang(event.detail.value);
      }
    };
    const pollInterval = setInterval(() => {
      const current = localStorage.getItem("code");
      if (current && current !== lang) {
        setLang(current);
      }
    }, 500);
    document.addEventListener("mintlify-localstorage", onMintlifyStorage);
    return () => {
      document.removeEventListener("mintlify-localstorage", onMintlifyStorage);
      clearInterval(pollInterval);
    };
  }, [lang]);
  const resolvedBody = useMemo(() => {
    try {
      const value = JSON.parse(lang);
      const useCamelCase = value === "typescript";
      return useCamelCase ? convertToCamelCase(body) : body;
    } catch {
      return body;
    }
  }, [body, lang]);
  const resolvedPath = useMemo(() => {
    try {
      const value = JSON.parse(lang);
      const useCamelCase = value === "typescript";
      return useCamelCase ? convertToCamelCase(path) : path;
    } catch {
      return path;
    }
  }, [path, lang]);
  return <ParamField body={resolvedBody} path={resolvedPath} {...props}>
			{children}
		</ParamField>;
};

<Note>
  Mints a per-customer token — a scoped `am_jwt_` credential — so a self-hosted or downstream app can call Autumn directly without your secret key. Authenticated with your **secret key**. Returns a short-lived access token (1h) and a rotating refresh token (24h), both bound to a single customer.
</Note>

### How it works

1. Your backend calls `keys.mint` with your secret key to issue a token pair for a customer.
2. Hand the **access token** to that customer's app. It can call `check`, `track`, `customers.get` and `entities.get` — always scoped to that customer, even if a different `customer_id` is sent.
3. Before the access token expires, the app calls [`keys.refresh`](/api-reference/keys/refreshKey) with its **refresh token** to rotate a fresh pair — no secret key required.

<CodeGroup>
  ```typescript TypeScript theme={null}
  const { accessToken, refreshToken } = await autumn.keys.mint({
    customerId: "cus_123",
  });
  ```

  ```bash cURL theme={null}
  curl -X POST "https://api.useautumn.com/v1/keys.mint" \
    -H "Authorization: Bearer am_sk_live_..." \
    -H "Content-Type: application/json" \
    -d '{ "customer_id": "cus_123" }'
  ```
</CodeGroup>

### Body Parameters

<DynamicParamField body="customer_id" type="string" required>
  The customer to mint a token for.
</DynamicParamField>

<DynamicParamField body="indefinite" type="boolean">
  If true, mint a non-expiring access token (no refresh token). Revoke via keys.revoke.
</DynamicParamField>

### Response

<DynamicResponseField name="access_token" type="string">
  Access token (1h, or non-expiring if indefinite), prefixed `am_jwt_`.
</DynamicResponseField>

<DynamicResponseField name="refresh_token" type="string">
  Rotating refresh token (24h). Omitted for indefinite tokens.
</DynamicResponseField>

<DynamicResponseField name="expires_at" type="number | null">
  Access-token expiry, ms since epoch. null for indefinite tokens.
</DynamicResponseField>

<DynamicResponseField name="refresh_expires_at" type="number">
  Refresh-token expiry, ms since epoch. Omitted for indefinite tokens.
</DynamicResponseField>

<ResponseExample>
  ```json 200 theme={null}
  {
    "access_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
    "refresh_token": "am_jwt_eyJhbGciOiJIUzI1NiJ9...",
    "expires_at": 1781113864000,
    "refresh_expires_at": 1781196664000
  }
  ```
</ResponseExample>


## OpenAPI

````yaml openapi POST /v1/keys.mint
openapi: 3.1.0
info:
  title: Autumn API
  version: 2.3.0
servers:
  - url: https://api.useautumn.com
    description: Production server
security:
  - secretKey: []
paths:
  /v1/keys.mint:
    post:
      tags:
        - keys
      description: >-
        Mints a per-customer token (a scoped `am_jwt_` credential) so a
        downstream / self-hosted app can call Autumn directly without your
        secret key. Returns a short-lived access token plus a rotating refresh
        token, both bound to the given customer. Authenticated with your secret
        key.
      operationId: mintKey
      parameters:
        - name: x-api-version
          in: header
          required: true
          schema:
            type: string
            default: 2.3.0
          x-speakeasy-globals-hidden: true
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                customer_id:
                  type: string
                  description: The customer to mint a token for.
                indefinite:
                  type: boolean
                  description: >-
                    If true, mint a non-expiring access token (no refresh
                    token). Revoke via keys.revoke.
              required:
                - customer_id
              title: MintKeyParams
              examples:
                - customer_id: cus_123
            example:
              customer_id: cus_123
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                    description: >-
                      Access token (1h, or non-expiring if indefinite), prefixed
                      `am_jwt_`.
                  refresh_token:
                    type: string
                    description: >-
                      Rotating refresh token (24h). Omitted for indefinite
                      tokens.
                  expires_at:
                    anyOf:
                      - type: number
                      - type: 'null'
                    description: >-
                      Access-token expiry, ms since epoch. null for indefinite
                      tokens.
                  refresh_expires_at:
                    type: number
                    description: >-
                      Refresh-token expiry, ms since epoch. Omitted for
                      indefinite tokens.
                required:
                  - access_token
                  - expires_at
                examples:
                  - access_token: am_jwt_eyJhbGciOiJIUzI1NiJ9...
                    refresh_token: am_jwt_eyJhbGciOiJIUzI1NiJ9...
                    expires_at: 1781113864000
                    refresh_expires_at: 1781196664000
              example:
                access_token: am_jwt_eyJhbGciOiJIUzI1NiJ9...
                refresh_token: am_jwt_eyJhbGciOiJIUzI1NiJ9...
                expires_at: 1781113864000
                refresh_expires_at: 1781196664000
      x-codeSamples:
        - lang: typescript
          label: Typescript (SDK)
          source: |-
            import { Autumn } from 'autumn-js'

            const autumn = new Autumn()

            const result = await autumn.keys.mint({
              customerId: "cus_123",
            });
        - lang: python
          label: Python (SDK)
          source: |-
            from autumn_sdk import Autumn

            autumn = Autumn(secret_key="am_sk_test...")

            res = autumn.keys.mint(customer_id="cus_123")
components:
  securitySchemes:
    secretKey:
      type: http
      scheme: bearer
      bearerFormat: JWT

````