An Identity Assertion Authorization Grant (ID-JAG) is a short-lived JWT, signed by your environment’s AuthKit domain, that asserts a user’s identity to a third-party service. The receiving service verifies the assertion against your AuthKit domain’s JWKS.
Mints an Identity Assertion Authorization Grant (ID-JAG) for a user, signed by the environment’s AuthKit domain, for presentation to a third-party service. When auth_time is omitted, it is derived from the user’s most recent active session.
cURL
| curl --request POST \ | |
| --url "https://api.workos.com/user_management/id_jag/token" \ | |
| --header "Authorization: Bearer sk_example_123456789" \ | |
| --header "Content-Type: application/json" \ | |
| -d @- <<'BODY' | |
| { | |
| "audience": "https://other-app.example.com", | |
| "user_id": "user_01E4ZCR3C56J083X43JQXF3JK5" | |
| } | |
| BODY |
| require "workos" | |
| WorkOS.configure do |config| | |
| config.api_key = "sk_example_123456789" | |
| end | |
| WorkOS.client.user_management.create_token( | |
| audience: "https://other-app.example.com", | |
| user_id: "user_01E4ZCR3C56J083X43JQXF3JK5" | |
| ) |
| from workos import WorkOSClient | |
| client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789") | |
| client.user_management.create_token( | |
| audience="https://other-app.example.com", user_id="user_01E4ZCR3C56J083X43JQXF3JK5" | |
| ) |
| package main | |
| import ( | |
| "context" | |
| "github.com/workos/workos-go/v9" | |
| ) | |
| func main() { | |
| client := workos.NewClient("sk_example_123456789") | |
| _, err := client.UserManagement().CreateToken(context.Background(), &workos.UserManagementCreateTokenParams{ | |
| Audience: "https://other-app.example.com", | |
| UserID: "user_01E4ZCR3C56J083X43JQXF3JK5", | |
| }) | |
| if err != nil { | |
| panic(err) | |
| } | |
| } |
| <?php | |
| use WorkOS\WorkOS; | |
| $workos = new WorkOS( | |
| apiKey: "sk_example_123456789", | |
| clientId: "client_123456789", | |
| ); | |
| $workos | |
| ->userManagement() | |
| ->createToken( | |
| audience: "https://other-app.example.com", | |
| userId: "user_01E4ZCR3C56J083X43JQXF3JK5", | |
| ); |
| import com.workos.WorkOS; | |
| import com.workos.usermanagement.UserManagementApi.CreateTokenOptions; | |
| WorkOS workos = new WorkOS("sk_example_123456789"); | |
| CreateTokenOptions options = CreateTokenOptions.builder() | |
| .audience("https://other-app.example.com") | |
| .userId("user_01E4ZCR3C56J083X43JQXF3JK5") | |
| .build(); | |
| workos.userManagement.createToken(options); |
| using WorkOS; | |
| var client = new WorkOSClient(new WorkOSOptions { | |
| ApiKey = "sk_example_123456789", | |
| ClientId = "client_123456789", | |
| }); | |
| await client.UserManagement.CreateTokenAsync(new UserManagementCreateTokenOptions { | |
| Audience = "https://other-app.example.com", | |
| UserId = "user_01E4ZCR3C56J083X43JQXF3JK5", | |
| }); |
| use workos::Client; | |
| use workos::user_management::CreateTokenParams; | |
| #[tokio::main] | |
| async fn main() -> Result<(), workos::Error> { | |
| let client = Client::builder() | |
| .api_key("sk_example_123456789") | |
| .client_id("client_123456789") | |
| .build(); | |
| let _result = client | |
| .user_management() | |
| .create_token( | |
| CreateTokenParams { | |
| audience: "https://other-app.example.com".into(), | |
| user_id: "user_01E4ZCR3C56J083X43JQXF3JK5".into(), | |
| ..Default::default() | |
| } | |
| ) | |
| .await?; | |
| Ok(()) | |
| } |
| { | |
| "access_token": "eyJ0eXAiOiJvYXV0aC1pZC1qYWcrand0IiwiYWxnIjoiUlMyNTYifQ...", | |
| "issued_token_type": "urn:ietf:params:oauth:token-type:id-jag", | |
| "expires_at": 1784767602 | |
| } |
Feature flagged
POST/user_management
Returns
Directory Sync Continue to the next section
Up next