com.atproto.server.getServiceAuth

atproto-lexicons.bsky.social

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Get a signed token on behalf of the requesting DID for the requested service.",
      "errors": [
        {
          "description": "Indicates that the requested expiration date is not a valid. May be in the past or may be reliant on the requested scopes.",
          "name": "BadExpiration"
        }
      ],
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "token": {
              "type": "string"
            }
          },
          "required": [
            "token"
          ],
          "type": "object"
        }
      },
      "parameters": {
        "properties": {
          "aud": {
            "description": "The DID or `did#serviceId` reference of the service that the token will be used to authenticate with.",
            "maxLength": 2048,
            "type": "string"
          },
          "exp": {
            "description": "The time in Unix Epoch seconds that the JWT expires. Defaults to 60 seconds in the future. The service may enforce certain time bounds on tokens depending on the requested scope.",
            "type": "integer"
          },
          "lxm": {
            "description": "Lexicon (XRPC) method to bind the requested token to",
            "format": "nsid",
            "type": "string"
          }
        },
        "required": [
          "aud"
        ],
        "type": "params"
      },
      "type": "query"
    }
  },
  "id": "com.atproto.server.getServiceAuth",
  "lexicon": 1
}

Validate Record

Validate a record against com.atproto.server.getServiceAuth

Validation Options
Treat any remaining unresolved references as valid

Metadata

DID
did:plc:6msi3pj7krzih5qxqtryxlzw
CID
bafyreiaw2itjl4tfvckxjkkmaeo4dvjzgh3iajov5ilxxsqfigqhqv3uei
Indexed At
2026-10-03 20:32 UTC
AT-URI
at://did:plc:6msi3pj7krzih5qxqtryxlzw/com.atproto.lexicon.schema/com.atproto.server.getServiceAuth

Version History (4 versions)

Similar Lexicons

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • The lxm named in service-auth JWTs minted for the BlueHarbor backend (aud did:web:blueharbor.at). The backend verifies the JWT against the caller's DID document and exchanges it for a BlueHarbor session token. Defined h…

  • Exchange a proxied service-auth call for a short-lived direct-access token bound to the viewer's DID.

Lexicon Garden

@