curl --request POST \
  --url https://api.aireserve.com/v1/token \
  --header 'Content-Type: application/json' \
  --header 'DPoP: <dpop>' \
  --data '
{
  "clientId": "arn:aws:signin:::devtools/same-device",
  "grantType": "authorization_code",
  "code": "SplxlOBeZQQYbYS6WxSbIA",
  "redirectUri": "http://127.0.0.1:49152/oauth/callback",
  "codeVerifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}
'

{
  "accessToken": {
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "sessionToken": "<string>"
  },
  "tokenType": "aws_sigv4",
  "expiresIn": 900,
  "refreshToken": "<string>",
  "idToken": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

AWS CLI login

Exchange or refresh AWS credentials

Called by the AWS CLI after receiving the authorization code. Accepts an authorization_code grant (with PKCE codeVerifier) or a refresh_token grant for silent renewal. The request body uses camelCase field names (AWS Signin service convention) and JSON or form encoding. A DPoP proof JWT must be sent in the DPoP request header on every call. Returns real 15-minute AWS STS credentials (aws_sigv4) for the client’s isolated AWS account; AWS service calls made with these credentials go directly to AWS. The absolute refresh window is 12 hours; after that aws login must be run again. No AI Reserve API key is required; the authorization code or refresh token is the credential.

POST

token

curl --request POST \
  --url https://api.aireserve.com/v1/token \
  --header 'Content-Type: application/json' \
  --header 'DPoP: <dpop>' \
  --data '
{
  "clientId": "arn:aws:signin:::devtools/same-device",
  "grantType": "authorization_code",
  "code": "SplxlOBeZQQYbYS6WxSbIA",
  "redirectUri": "http://127.0.0.1:49152/oauth/callback",
  "codeVerifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}
'

{
  "accessToken": {
    "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "sessionToken": "<string>"
  },
  "tokenType": "aws_sigv4",
  "expiresIn": 900,
  "refreshToken": "<string>",
  "idToken": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

{
  "error": "<string>",
  "message": "<string>"
}

Headers

DPoP

string

required

DPoP (Demonstrating Proof-of-Possession) proof JWT, signed with the CLI's ephemeral private key. Contains htm (HTTP method), htu (endpoint URI), iat, and jti claims.

Body

clientId

string

required

AWS CLI client identifier. Must match the value used in /v1/authorize.

grantType

enum<string>

required

authorization_code — first token exchange after user approval. refresh_token — silent renewal using a prior refreshToken.

Available options:

authorization_code,

refresh_token

code

string

Required for authorization_code grant. The authorization code from the /v1/authorize redirect.

redirectUri

string<uri>

Required for authorization_code grant. Must exactly match the redirect_uri sent to /v1/authorize.

codeVerifier

string

Required for authorization_code grant. The PKCE code verifier whose SHA-256 hash was sent as code_challenge.

refreshToken

string

Required for refresh_token grant. The refreshToken from a prior response.

Response

Real 15-minute AWS STS credential bundle for the client's isolated AWS account. The CLI caches these in ~/.aws/login/cache/. On authorization_code grants, idToken is also returned; on refresh_token grants it is omitted.

accessToken

object

required

Real AWS STS temporary credential set for the client's isolated AWS account.

Show child attributes

tokenType

enum<string>

required

Always aws_sigv4. Indicates these credentials sign requests with AWS SigV4.

Available options:

aws_sigv4

expiresIn

integer

required

Whole seconds remaining until accessToken credentials expire.

Required range: 1 <= x <= 900

Example:

900

refreshToken

string

required

Opaque token used with the refresh_token grant for silent renewal. Valid for an absolute 12-hour window from first login. After 12 hours, aws login must be run again.

idToken

string

JWT identity token. Present on authorization_code grant responses; omitted on refresh_token grant responses.

Reference

Endpoints

Exchange or refresh AWS credentials

Headers

Body

Response