Authentication

Operations for generating and managing API tokens

Generate JWT token

post

Generate a JWT token for SDK authentication.

Authentication

This endpoint uses client credentials (not HMAC signature). You must provide:

• x-client-id: Your project's client ID

• x-client-secret: Your project's client secret

Important Notes:

• Tokens expire after the specified duration (default: 1 hour)

• Use this endpoint from your backend to obtain tokens for frontend SDK usage

• Never expose your client secret in client-side code

Authorizations

x-client-idstringRequired

Your project client ID from orda dashboard

x-signaturestringRequired

HMAC-SHA256 signature of canonical request body using your client secret

x-timestampstringRequired

Unix timestamp in milliseconds for replay protection (recommended)

Header parameters

x-client-idstringRequired

Your project's client ID

Example: prj_abc123def456ghi789

x-client-secretstringRequired

Your project's client secret

Example: sec_xyz789abc123def456

Body

expiresIninteger · min: 60 · max: 86400Optional

Token expiration time in seconds (default 3600 = 1 hour)

Default: 3600Example: 3600

Responses

200

Token generated successfully

application/json

tokenstringOptional

JWT token for SDK authentication

Example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

expiresAtstring · date-timeOptional

ISO 8601 timestamp when the token expires

Example: 2025-01-15T11:00:00.000Z

401

Unauthorized - Invalid or missing credentials

application/json

429

Too Many Requests - Rate limit exceeded

application/json

500

Internal Server Error

application/json

post/tokens

POST /v1/tokens HTTP/1.1
Host: api.orda.network
x-client-id: prj_abc123def456ghi789
x-signature: YOUR_API_KEY
x-timestamp: YOUR_API_KEY
x-client-secret: sec_xyz789abc123def456
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiresAt": "2025-01-15T11:00:00.000Z"
}