Using OAuth Clients - Sixtyfour AI Documentation

An OAuth client lets a server exchange a signed JWT assertion for a short-lived access token instead of holding a long-lived API key. Sixtyfour verifies the assertion against a public key you upload or publish at a JWKS URL; there is no client secret. Organization admins and owners manage OAuth clients. See Roles and Permissions.

Property	Value
Grant type	`client_credentials`
Client auth	`private_key_jwt`
Signing algorithm	`RS256`
Scope	`full_access` (the only scope; may be omitted)
Token URL	`https://api.sixtyfour.ai/oauth/token`
Discovery URL	`https://api.sixtyfour.ai/.well-known/oauth-authorization-server`

Open OAuth Clients

Go to Settings → OAuth Clients.

OAuth Clients tab in the API Keys settings

Create a client

Click Create client
Enter a Client Name (for example, my-production-app)
Optionally enter a JWKS URL: a public HTTPS endpoint that serves your JSON Web Key Set

The JWKS choice is permanent. Provide a JWKS URL for automatic key discovery and rotation, or leave it blank to upload public keys manually. You cannot switch modes after creation.

Click Create and continue

Sixtyfour generates a client_id and drops you into the client detail view.

Register a public key

Pick the flow that matches how you created the client.

With a JWKS URL

If you configured a JWKS URL, Sixtyfour fetches your public keys from that endpoint automatically. Validate it at any time:

On the client detail page, click Validate JWKS
Confirm the health indicator shows a green check and a recent validation timestamp

With an uploaded public key

If you did not set a JWKS URL, generate an RSA key pair and upload the public half:

openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.pem

Click Upload key
Paste the contents of public.pem into Public Key (PEM) (including the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines)
Click Upload key

Copy the generated Key ID (kid). It goes in the JWT header.

Keep private.pem on the server that signs assertions. Never commit it or send it to a browser.

Request an access token

Your server signs a short-lived JWT assertion with the private key, then POSTs it to the token endpoint.

import jwt, time, uuid, requests

# pip install PyJWT cryptography requests

CLIENT_ID = "YOUR_CLIENT_ID"
KEY_ID = "YOUR_KEY_ID"
TOKEN_URL = "https://api.sixtyfour.ai/oauth/token"
ISSUER = TOKEN_URL.replace("/oauth/token", "")  # or fetch from discovery

# Load your private key (keep this secret, never commit it)
with open("private.pem") as f:
    private_key = f.read()

# Build the signed JWT assertion
now = int(time.time())
assertion = jwt.encode(
    {
        "iss": CLIENT_ID,
        "sub": CLIENT_ID,
        "aud": ISSUER,
        "iat": now,
        "exp": now + 60,
        "jti": str(uuid.uuid4()),
    },
    private_key,
    algorithm="RS256",
    headers={"kid": KEY_ID},
)

# Exchange for an access token
resp = requests.post(TOKEN_URL, data={
    "grant_type": "client_credentials",
    "client_id": CLIENT_ID,
    "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
    "client_assertion": assertion,
    "scope": "full_access",
})
access_token = resp.json()["access_token"]
print("Access token:", access_token)

import jwt from "jsonwebtoken";
import { randomUUID } from "node:crypto";
import { readFileSync } from "node:fs";

const CLIENT_ID = "YOUR_CLIENT_ID";
const KEY_ID = "YOUR_KEY_ID";
const TOKEN_URL = "https://api.sixtyfour.ai/oauth/token";
const ISSUER = "https://api.sixtyfour.ai";

const privateKey = readFileSync("private.pem", "utf8");

const now = Math.floor(Date.now() / 1000);
const assertion = jwt.sign(
  {
    iss: CLIENT_ID,
    sub: CLIENT_ID,
    aud: ISSUER,
    iat: now,
    exp: now + 60,
    jti: randomUUID(),
  },
  privateKey,
  { algorithm: "RS256", header: { kid: KEY_ID } },
);

const body = new URLSearchParams({
  grant_type: "client_credentials",
  client_id: CLIENT_ID,
  client_assertion_type:
    "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
  client_assertion: assertion,
  scope: "full_access",
});

const resp = await fetch(TOKEN_URL, {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body,
});
const { access_token } = await resp.json();
console.log("Access token:", access_token);

The response contains a bearer token:

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "full_access"
}

Call the API

Send the token in the Authorization header on any Sixtyfour API request:

Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json

OAuth access tokens work on all endpoints that accept x-api-key. Do not send both headers on the same request. Run the token exchange server-side only — never from a browser.

Managing a client

The client detail page exposes everything you need after setup.

Adjust token TTL

Token TTL sets how long issued access tokens stay valid: Backend default (1 hour), 1 minute, 5 minutes, 1 hour or 24 hours. The token response’s expires_in reflects the setting.

Rotate keys

If you configured a JWKS URL, publish the new key in your JWKS document and click Validate JWKS. Sixtyfour picks up the new kid automatically on the next fetch. If you uploaded a public key directly, upload the new key, switch your signer to the new kid, then revoke the old key from the Public Keys table.

Permanently disable a client

Clicking Disable client is irreversible: it immediately invalidates all outstanding tokens and the client cannot be re-enabled. If you only need a temporary pause, rotate keys instead. To restore access after disabling, create a new client.

Delete a client

Click Delete client on the detail page. Deleting revokes all tokens and keys for that client and cannot be undone.

​Open OAuth Clients

​Create a client

​Register a public key

​With a JWKS URL

​With an uploaded public key

​Request an access token

​Call the API

​Managing a client

​Adjust token TTL

​Rotate keys

​Permanently disable a client

​Delete a client

Open OAuth Clients

Create a client

Register a public key

With a JWKS URL

With an uploaded public key

Request an access token

Call the API

Managing a client

Adjust token TTL

Rotate keys

Permanently disable a client

Delete a client