JIT Tokens - Anti AI

A Just-in-Time (JIT) token is a short-lived credential your agent gets right when it needs to make an API call — valid for 10 minutes, scoped to exactly what the agent needs, and expiring automatically.

Why short-lived tokens?

With a long-lived API key, a compromised agent gives an attacker access until someone notices — hours or days. With JIT tokens, the window is at most 10 minutes. After that, the token expires and Anti AI can block re-authentication immediately.

The token lifecycle

Agent requests token (client_id + client_secret + scope)
Anti AI validates credentials
Anti AI checks policy — is this scope allowed?
Anti AI issues a signed JWT (expires in 10 min)
Agent uses token for API calls
Token expires — agent requests a new one automatically

The SDK handles steps 1–4 and 6 automatically.

Token lifetimes

Situation	Lifetime
Standard	10 minutes
High-risk scopes (`:write`, `:delete`, `*:admin`)	15 minutes max
Custom per-agent TTL	5 minutes to 24 hours

Revocation

Revoke any token instantly from the dashboard or API. The SDK detects revocations within 15 seconds via background TRL polling.