> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Machine identity

> Get a signed token that identifies the Mount Thor Mac running your workload

The machine identity endpoint lets an application running on a Mount Thor
bare-metal Mac obtain a short-lived, signed token for that Mac. It is an
on-machine endpoint, not a remote API. This endpoint is not available for
Mount Thor VMs.

## Request a token

Send a `PUT` request:

```shell theme={null}
curl -sS -X PUT \
  http://169.254.169.254/latest/api/token
```

The address is local to the Mac. It is not a Mount Thor internet endpoint and
cannot be used to request a token for another machine.

The endpoint returns:

```json theme={null}
{
  "access_token": "<signed JWT>",
  "token_type": "Bearer",
  "expires_in": 300
}
```

The address and `PUT /latest/api/token` form follow the standard IMDS layout.
The signed-JWT JSON response is part of Mount Thor's machine-identity
contract.

`expires_in` is the number of seconds for which the token is valid. Request a
new token after it expires rather than storing it for reuse.

## Verify the token

`access_token` is a JWT. A synthetic example looks like this after decoding;
the values are illustrative and the signature is not shown in full:

```text theme={null}
header:    {"alg":"ES384","kid":"example-key-1","typ":"JWT"}
payload:   {"iss":"https://identity.example.mountthor.dev",
            "sub":"machine:C02ABC123456",
            "aud":"mountthor.machine-identity",
            "serial_number":"C02ABC123456",
            "iat":1761500000,
            "exp":1761500300}
signature: <signature over the header and payload>
```

The issuer is the `iss` claim in the JWT payload. It identifies the service
that signed the token. It is not supplied separately in the HTTP response.

Before trusting the token:

1. Read the token's `iss` claim and check it against the issuer you expect.
2. Fetch that issuer's public keys from
   `https://<issuer>/.well-known/jwks.json`.
3. Verify the JWT signature with those keys.
4. Check the issuer, expected audience, expiry, and machine identity claims.

Do not trust values that are only decoded from the JWT. The signature must be
valid, and the claims must match the values your application expects.

## Errors

* `503`: the Mac cannot currently provide a machine identity token. No
  unsigned token is returned.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.