Authentication
Overview
The authentication APIs provide the methods to switch between different kinds of authentication tokens. Some APIs only accept the stateless access token to be used for better performance.
The authentication APIs provide a way to switch from a Service Account Key ID and Secret Key pair to a stateless access token. The returned access token can be used as authentication.
The authentication APIs provide a way to switch from a Service Account Key ID and Secret Key pair to a stateless access token. The returned access token can be used as
BearerRate Limits
These APIs have rate limiting in place. Requests are limited to 20 requests per second and 18000 requests per thirty minutes per endpoint. The APIs respond with a HTTP status code if the rate limit is exceeded.
429Download OpenAPI specification:
Token Exchange API
Exchange a Service Account Key ID and Secret Key pair to a Stateless Access Token. The access token is always scoped to a project and optionally even to an environment. Following the principle of least privilege it is a good practice to scope the token to both project and environment ID if applicable.
The request can optionally contain a list of permissions that should be scoped to the access token. If left out then all scopes will be included by default.
The returned access token is a standard RFC 7519 JWT and has a 1 hour expiration time (TTL).
The Token Exchange API has a maximum limit of 200 permissions that can be included in the Stateless Access Token. Because all permissions are included by default this cap can be hit when no are being specified in the request. This might happen if the Service Account has been assigned multiple roles that each grant their own permissions. If the permission cap is reached the API will return an error. In this case it's required to specify the exact permissions that the Stateless Access Token should have when using the exchange API.
The request can optionally contain a list of permissions that should be scoped to the access token. If left out then all scopes will be included by default.
The returned access token is a standard RFC 7519 JWT and has a 1 hour expiration time (TTL).
The Token Exchange API has a maximum limit of 200 permissions that can be included in the Stateless Access Token. Because all permissions are included by default this cap can be hit when no
scopesCode samples for "Token Exchange API":
Request example
curl -X POST \ -H "Content-Type: application/json" \ -d '{ "scopes": [ "unity.projects.get", "unity.projects.create" ]}' \ "https://services.api.unity.com/auth/v1/token-exchange"
Response example
{ "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1MTYyMzkwMjJ9.tbDepxpstvGdW8TC3G8zg4B6rUYAOvfzdceoH48wgRQ"}