Integration Tokens

Integration Tokens provide short-lived server-to-server access grants. By default a grant is scoped to its issuing user. An organization administrator can explicitly request organization scope with organizationId.

Browser launches are handled by Xentree Connect: LMS sends a signed assertion by HTTP form POST, then Xentree redirects with an opaque, single-use ticket. Xentree never places bearer JWTs in URLs and does not support iframe or web-component embedding.

Tokens are signed with RS256 using per-subject key pairs. Each grant is short-lived, revocable, and bound to a specific set of scopes and an allowed origin.

Core capabilities

issue short-lived RS256 integration grants

verify token validity and check JTI revocation status

revoke a token immediately by JTI

rotate a token (revoke old, issue new in one atomic call)

expose the per-subject JWKS endpoint for third-party verification

retrieve the public key fingerprint for out-of-band key pinning

admin observability of revoked tokens

Authentication and scopes

All Integration Token endpoints require bearer or API key auth.

Recommended API key scopes:

integrations:read for verify, jwks, fingerprint

integrations:write for grant, revoke, rotate

REST endpoints

Issue integration grant

Issue a short-lived RS256-signed JWT for current user, or an explicitly selected organization.

POST /api/integration/grant

Representative request:

{
  "mode": "api",
  "origin": "https://partner.example.com",
  "scopes": ["profile:read", "quota:read"],
  "ttlSeconds": 120
}

Organization scope (caller must be that organization's administrator):

{
  "organizationId": "<organization-uuid>",
  "mode": "api",
  "origin": "https://partner.example.com"
}

Verify integration token

Check validity and revocation status of an integration JWT.

POST /api/integration/verify

Revoke integration token

Immediately invalidate a token by adding its JTI to the revocation list.

POST /api/integration/revoke

Rotate integration token

Revoke an existing token and issue a fresh one atomically.

POST /api/integration/rotate

Subject JWKS

Return active RS256 public keys for a user or organization subject in JWK Set format. Use subjectType and subjectId returned by grant response.

GET /api/integration/jwks
Query params: subjectType (user or organization), subjectId

This endpoint is public — no auth required.

Public key fingerprint

Return the SHA-256 fingerprint of subject's active public key for out-of-band key pinning.

GET /api/integration/fingerprint
Query params: subjectType (user or organization), subjectId

This endpoint is public — no auth required.

Rate limits

Grant and rotate operations are rate-limited per subject per principal. When the limit is exceeded, the API returns 429 Too Many Requests with the following headers:

Header	Description
`X-RateLimit-Limit`	Maximum requests allowed in the window
`X-RateLimit-Remaining`	Remaining requests in the current window
`X-RateLimit-Reset`	Unix timestamp when the window resets
`Retry-After`	Seconds to wait before retrying

Core capabilities#

Authentication and scopes#

REST endpoints#

Issue integration grant#

Verify integration token#

Revoke integration token#

Rotate integration token#

Subject JWKS#

Public key fingerprint#

Rate limits#