IAM & Access

Token Exchange

Exchange API keys for short-lived bearer tokens used by secure server-side Infuse API integrations.

Personal and service-account API keys can be exchanged for short-lived bearer tokens through the IAM auth endpoint.

Use token exchange when your integration should keep the long-lived API key in secret storage and call downstream APIs with a short-lived token.

IAM token exchange does not automatically make an IAM API key a replacement for a legacy Infuse IoT admin key. Use Infuse IoT > API Access for integrations that still require the legacy credential flow.

Exchange an API Key

POST /iam/auth/token
Content-Type: application/json

{
  "apiKey": "ik_<keyId>.<keySecret>"
}

The response includes:

accessToken
tokenType
expiresAt

Use the returned token as a bearer token until it expires:

Authorization: Bearer <accessToken>

Direct API-Key Auth

Some APIs can accept the API key directly:

Authorization: ApiKey ik_<keyId>.<keySecret>

Direct API-key auth only works when it is enabled for the organisation and supported by the API being called. If direct auth is not enabled, exchange the API key for a bearer token first.

Token exchange is the recommended default because the long-lived API key stays in secret storage while normal API calls use a short-lived bearer token.

Requirements

The credential must not be revoked or expired. Its owning user must still be a member of the organisation, or its owning service account must be active and unexpired.

Authorization uses the owning identity's current roles, group memberships, direct grants, status, and organisation membership. The API key does not carry a separate copy of that access.

API Keys

Create personal and service-account API keys for programmatic access.

Rotate and Revoke Credentials

Safely replace or disable personal and service-account API keys.