Skip to main content
The machine identity endpoint lets an application running on a Mount Thor bare-metal Mac obtain a short-lived, signed token for that Mac. It is an on-machine endpoint, not a remote API. This endpoint is not available for Mount Thor VMs.

​
Request a token

Send a PUT request:
The address is local to the Mac. It is not a Mount Thor internet endpoint and cannot be used to request a token for another machine. The endpoint returns:
The address and PUT /latest/api/token form follow the standard IMDS layout. The signed-JWT JSON response is part of Mount Thor’s machine-identity contract. expires_in is the number of seconds for which the token is valid. Request a new token after it expires rather than storing it for reuse.

​
Verify the token

access_token is a JWT. A synthetic example looks like this after decoding; the values are illustrative and the signature is not shown in full:
The issuer is the iss claim in the JWT payload. It identifies the service that signed the token. It is not supplied separately in the HTTP response. Before trusting the token:
  1. Read the token’s iss claim and check it against the issuer you expect.
  2. Fetch that issuer’s public keys from https://<issuer>/.well-known/jwks.json.
  3. Verify the JWT signature with those keys.
  4. Check the issuer, expected audience, expiry, and machine identity claims.
Do not trust values that are only decoded from the JWT. The signature must be valid, and the claims must match the values your application expects.

​
Errors

  • 503: the Mac cannot currently provide a machine identity token. No unsigned token is returned.