Exchange token

const session = await client.exchangeToken({
  partnerJwt,
  emailFallback: 'u-8f21c4@anon.your-platform.example.com',
})

curl -X POST "https://stage.ci-hub.com/api/v1/auth/exchangeToken" \
  -H "Authorization: Bearer $PARTNER_JWT" \
  -H "Content-Type: application/json" \
  -d '{"email": "u-8f21c4@anon.your-platform.example.com"}'

const response = await fetch(
  'https://stage.ci-hub.com/api/v1/auth/exchangeToken',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${partnerJwt}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ email: 'u-8f21c4@anon.your-platform.example.com' }),
  }
)

import { CiHubAccessClient, TokenManager } from '@ci-hub/access-sdk'
import { signPartnerJwt } from '@ci-hub/access-sdk/node'

// Server-side: the private key must never reach a browser.
const partnerJwt = await signPartnerJwt({
  privateKeyPem: process.env.PARTNER_PRIVATE_KEY!,
  keyId: 'your-kid',
  claims: {
    iss: 'https://auth.your-platform.example.com',
    aud: 'https://api.ci-hub.com',
    sub: 'user-12345',
    email: 'jane@customer.example.com',
  },
})

const client = new CiHubAccessClient({ baseUrl: 'https://stage.ci-hub.com/api/v1' })
const tokens = new TokenManager(client)

const session = await client.exchangeToken({ partnerJwt })
await tokens.setCihubSession(session)

PARTNER_JWT=$(node -e "
  const jwt = require('jsonwebtoken');
  const fs = require('fs');
  const privateKey = fs.readFileSync('./private.pem');
  const now = Math.floor(Date.now() / 1000);
  console.log(jwt.sign({
    iss: 'https://auth.your-platform.example.com',
    aud: 'https://api.ci-hub.com',
    sub: 'user-12345',
    email: 'jane@customer.example.com',
    iat: now,
    exp: now + 3600
  }, privateKey, { algorithm: 'RS256', keyid: 'your-kid' }));
")

curl -X POST "https://stage.ci-hub.com/api/v1/auth/exchangeToken" \
  -H "Authorization: Bearer $PARTNER_JWT" \
  -H "Content-Type: application/json" \
  -d '{}'

import fs from 'node:fs'
import jwt from 'jsonwebtoken'

const privateKey = fs.readFileSync('./private.pem')
const now = Math.floor(Date.now() / 1000)

const partnerJwt = jwt.sign(
  {
    iss: 'https://auth.your-platform.example.com',
    aud: 'https://api.ci-hub.com',
    sub: 'user-12345',
    email: 'jane@customer.example.com',
    iat: now,
    exp: now + 3600,
  },
  privateKey,
  { algorithm: 'RS256', keyid: 'your-kid' }
)

const response = await fetch(
  'https://stage.ci-hub.com/api/v1/auth/exchangeToken',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${partnerJwt}`,
      'Content-Type': 'application/json',
    },
    body: '{}',
  }
)

if (!response.ok) {
  const { error } = await response.json()
  throw new Error(`${error.code}: ${error.message}`)
}

const { access_token, refresh_token, expires_in } = await response.json()