Exchange a GitHub OIDC token
curl --request POST \
--url https://api.reintersect.com/v0/apps/deploy-tokens/oidc \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.reintersect.com/v0/apps/deploy-tokens/oidc"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.reintersect.com/v0/apps/deploy-tokens/oidc', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.reintersect.com/v0/apps/deploy-tokens/oidc",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.reintersect.com/v0/apps/deploy-tokens/oidc"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.reintersect.com/v0/apps/deploy-tokens/oidc")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.reintersect.com/v0/apps/deploy-tokens/oidc")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_bodyDeploy
Exchange a GitHub OIDC token
Trade a GitHub Actions OIDC token for a short-lived deploy token.
POST
/
v0
/
apps
/
deploy-tokens
/
oidc
Exchange a GitHub OIDC token
curl --request POST \
--url https://api.reintersect.com/v0/apps/deploy-tokens/oidc \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.reintersect.com/v0/apps/deploy-tokens/oidc"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.reintersect.com/v0/apps/deploy-tokens/oidc', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.reintersect.com/v0/apps/deploy-tokens/oidc",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.reintersect.com/v0/apps/deploy-tokens/oidc"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.reintersect.com/v0/apps/deploy-tokens/oidc")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.reintersect.com/v0/apps/deploy-tokens/oidc")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body
The GitHub Action calls this endpoint to exchange a GitHub Actions OIDC token for a deploy token
(
reidep_…) that lasts 15 minutes and works for one app. Reintersect checks the token’s signature,
issuer and audience (the API origin), then matches its repository, ref and environment against the
app’s trusted repositories. Each repository can make at most 30 exchanges a minute. Responses carry
cache-control: no-store.
Body
| Field | Required | Description |
|---|---|---|
appId | Yes | The app to deploy. |
token | Yes | The GitHub OIDC JWT, requested with the API origin as audience. |
Response
| Field | Description |
|---|---|
appId | The app. |
deployToken | Send it as authorization: Bearer … to the tooling endpoints, or as REINTERSECT_API_KEY to the CLI. |
expiresAt | ISO 8601. |
previewOnly | true when this run may only deploy previews. See When a run may deploy production. |
Errors
_tag | Status | Cause |
|---|---|---|
ReintersectAppNotFoundError | 404 | No such app. |
ReintersectAppOidcTokenInvalidError | 401 | The OIDC token is invalid, expired or for another audience. |
ReintersectAppOidcUntrustedError | 403 | The app doesn’t trust this repository, branch or environment; repository names it. |
ReintersectApiRateLimitExceededError | 429 | Too many exchanges. |