> ## Documentation Index > Fetch the complete documentation index at: https://docs.aireserve.com/llms.txt > Use this file to discover all available pages before exploring further. # Exchange or refresh AWS credentials > Called by the AWS CLI after receiving the authorization code. Accepts an `authorization_code` grant (with PKCE `codeVerifier`) or a `refresh_token` grant for silent renewal. The request body uses camelCase field names (AWS Signin service convention) and JSON or form encoding. A DPoP proof JWT must be sent in the `DPoP` request header on every call. Returns real 15-minute AWS STS credentials (`aws_sigv4`) for the client's isolated AWS account; AWS service calls made with these credentials go directly to AWS. The absolute refresh window is 12 hours; after that `aws login` must be run again. No AI Reserve API key is required; the authorization code or refresh token is the credential. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/token openapi: 3.0.3 info: title: AI Reserve Gateway API description: >- The AI Reserve API surface — OpenAI-compatible chat completions, Anthropic-compatible messages, Bedrock Converse, images, video, files, text-to-speech, realtime voice sessions, and provider-hidden GPU infrastructure — all behind one endpoint and one API key. version: 1.0.0 servers: - url: https://api.aireserve.com security: - bearerAuth: [] tags: - name: Customers description: >- Per-end-customer usage, cost, and billable amounts for organizations that tag requests with their own customers. - name: GPU Infrastructure description: >- Provision and manage provider-hidden GPU instances. The recommended Instances API accepts workload requirements and an hourly price ceiling; AI Reserve handles provider placement internally. Every mutation is asynchronous and returns an operation to poll. - name: Customer keys description: >- Mint, list, and revoke API keys pinned to your own end customers (and their organizations), so spend splits per customer without per-request tagging. - name: AWS CLI login description: >- Browser-authorization endpoints consumed by `aws login --profile …` (AWS CLI v2.32.0+). All three routes are unauthenticated — the caller has no credential until `/v1/token` succeeds. paths: /v1/token: post: tags: - AWS CLI login summary: Exchange or refresh AWS credentials description: >- Called by the AWS CLI after receiving the authorization code. Accepts an `authorization_code` grant (with PKCE `codeVerifier`) or a `refresh_token` grant for silent renewal. The request body uses camelCase field names (AWS Signin service convention) and JSON or form encoding. A DPoP proof JWT must be sent in the `DPoP` request header on every call. Returns real 15-minute AWS STS credentials (`aws_sigv4`) for the client's isolated AWS account; AWS service calls made with these credentials go directly to AWS. The absolute refresh window is 12 hours; after that `aws login` must be run again. No AI Reserve API key is required; the authorization code or refresh token is the credential. operationId: awsCliToken parameters: - name: DPoP in: header required: true description: >- DPoP (Demonstrating Proof-of-Possession) proof JWT, signed with the CLI's ephemeral private key. Contains `htm` (HTTP method), `htu` (endpoint URI), `iat`, and `jti` claims. schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AwsCliLoginTokenRequest' examples: authorization_code: summary: First token exchange (authorization_code grant) value: clientId: arn:aws:signin:::devtools/same-device grantType: authorization_code code: SplxlOBeZQQYbYS6WxSbIA redirectUri: http://127.0.0.1:49152/oauth/callback codeVerifier: dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk refresh_token: summary: Silent renewal (refresh_token grant) value: clientId: arn:aws:signin:::devtools/same-device grantType: refresh_token refreshToken: eyJhbGciOiJSUzI1NiJ9... application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/AwsCliLoginTokenRequest' responses: '200': description: >- Real 15-minute AWS STS credential bundle for the client's isolated AWS account. The CLI caches these in `~/.aws/login/cache/`. On `authorization_code` grants, `idToken` is also returned; on `refresh_token` grants it is omitted. content: application/json: schema: type: object required: - accessToken - tokenType - expiresIn - refreshToken properties: accessToken: type: object description: >- Real AWS STS temporary credential set for the client's isolated AWS account. required: - accessKeyId - secretAccessKey - sessionToken properties: accessKeyId: type: string description: Temporary AWS access key ID. example: ASIAIOSFODNN7EXAMPLE secretAccessKey: type: string description: >- Temporary AWS secret access key. Never log or store this value. example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY sessionToken: type: string description: >- AWS session token. Must be included in every AWS API request alongside the access key and secret as `X-Amz-Security-Token`. tokenType: type: string enum: - aws_sigv4 description: >- Always `aws_sigv4`. Indicates these credentials sign requests with AWS SigV4. expiresIn: type: integer description: >- Whole seconds remaining until `accessToken` credentials expire. example: 900 minimum: 1 maximum: 900 refreshToken: type: string description: >- Opaque token used with the `refresh_token` grant for silent renewal. Valid for an absolute 12-hour window from first login. After 12 hours, `aws login` must be run again. idToken: type: string description: >- JWT identity token. Present on `authorization_code` grant responses; omitted on `refresh_token` grant responses. '400': description: >- Invalid request (`error: INVALID_REQUEST`): malformed fields, an invalid DPoP proof, or a replayed DPoP proof. content: application/json: schema: $ref: '#/components/schemas/AwsCliLoginError' '401': description: >- The one-time authorization code is invalid, expired, or already used (`error: AUTHCODE_EXPIRED`), or the refresh token is invalid, expired, revoked, or DPoP-bound to another key (`error: TOKEN_EXPIRED`). content: application/json: schema: $ref: '#/components/schemas/AwsCliLoginError' '403': description: >- The live portal user, organization, admin role, or linked AWS account no longer permits access (`error: INSUFFICIENT_PERMISSIONS`). content: application/json: schema: $ref: '#/components/schemas/AwsCliLoginError' '502': description: >- AWS STS did not issue a usable temporary credential set (`error: server_error`). content: application/json: schema: $ref: '#/components/schemas/AwsCliLoginError' security: [] components: schemas: AwsCliLoginTokenRequest: type: object required: - clientId - grantType properties: clientId: type: string description: >- AWS CLI client identifier. Must match the value used in `/v1/authorize`. grantType: type: string enum: - authorization_code - refresh_token description: >- `authorization_code` — first token exchange after user approval. `refresh_token` — silent renewal using a prior `refreshToken`. code: type: string description: >- Required for `authorization_code` grant. The authorization code from the `/v1/authorize` redirect. redirectUri: type: string format: uri description: >- Required for `authorization_code` grant. Must exactly match the `redirect_uri` sent to `/v1/authorize`. codeVerifier: type: string description: >- Required for `authorization_code` grant. The PKCE code verifier whose SHA-256 hash was sent as `code_challenge`. refreshToken: type: string description: >- Required for `refresh_token` grant. The `refreshToken` from a prior response. AwsCliLoginError: type: object required: - error - message properties: error: type: string description: Machine-readable Sign-In error code. message: type: string description: Human-readable explanation of the error. securitySchemes: bearerAuth: type: http scheme: bearer description: >- Your AI Reserve API key (aireserve_api_…) from the API Keys page in the portal (https://portal.aireserve.com/keys). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.