Get an agent access token
OAuth 2.0 token endpoint for agents running outside Runtype. An external agent authenticates as the OAuth client (private_key_jwt, client_secret_basic or client_secret_post) and gets a short-lived RFC 9068 access token whose sub is agent:<agentId> and whose aud is the requested resource, when the agent audience policy allows that resource. Errors follow RFC 6749 §5.2. Responses are never cached.
Request
Always client_credentials. Token exchange returns unsupported_grant_type.
The canonical resource URI (RFC 8707) the token is for, for example https://mcp.example.com/mcp. It must be on the agent audience policy for the principal grant.
Not accepted; the actor is the authenticated client.
Not accepted; name the target with resource.
A JWT signed with a registered key (private_key_jwt): iss and sub are the agent ID, aud is the agents issuer, jti is unique, and exp - iat is at most 300 seconds.
The agent ID. Required with client_secret; optional with a client assertion, whose sub names the agent.
An rt_agent_sk_ client secret (client_secret_post). Prefer HTTP Basic or a client assertion.
Space-separated scopes; each must be allowed by the policy entry for resource.
Response
An RFC 9068 at+jwt signed with the keys at /.well-known/jwks.json.
Seconds until the token expires; at most 300.