> ## Documentation Index
> Fetch the complete documentation index at: https://developers.reintersect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange a GitHub OIDC token

> Trade a GitHub Actions OIDC token for a short-lived deploy token.

> Reintersect apps are in developer preview. Names and limits can still change before general
> release.

The [GitHub Action](/ci) calls this endpoint to exchange a GitHub Actions OIDC token for a deploy token
(`reidep_…`) that lasts 15 minutes and works for one app. Reintersect checks the token's signature,
issuer and audience (the API origin), then matches its repository, ref and environment against the
app's trusted repositories. Each repository can make at most 30 exchanges a minute. Responses carry
`cache-control: no-store`.

## Body

| Field | Required | Description |
| - | - | - |
| `appId` | Yes | The app to deploy. |
| `token` | Yes | The GitHub OIDC JWT, requested with the API origin as audience. |

## Response

| Field | Description |
| - | - |
| `appId` | The app. |
| `deployToken` | Send it as `authorization: Bearer …` to the tooling endpoints, or as `REINTERSECT_API_KEY` to the CLI. |
| `expiresAt` | ISO 8601. |
| `previewOnly` | `true` when this run may only deploy previews. See [When a run may deploy production](/ci#when-a-run-may-deploy-production). |

## Errors

| `_tag` | Status | Cause |
| - | - | - |
| `ReintersectAppNotFoundError` | 404 | No such app. |
| `ReintersectAppOidcTokenInvalidError` | 401 | The OIDC token is invalid, expired or for another audience. |
| `ReintersectAppOidcUntrustedError` | 403 | The app doesn't trust this repository, branch or environment; `repository` names it. |
| `ReintersectApiRateLimitExceededError` | 429 | Too many exchanges. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.