---
title: "IAM"
permalink: "/docs/api-v2/iam"
description: "Open API Reference Docs for the API"
original_source: "openapi-spec/api-v2.yaml"
---

> **AI agents:** This is the Markdown version of a RevenueCat documentation page. For the complete documentation index, see [llms.txt](https://www.revenuecat.com/docs/llms.txt).


# Developer API (2.0.0)

Download OpenAPI specification:[Download](https://www.revenuecat.com/docs/redocusaurus/openapi-v2-iam.yaml)

## <a id="tag/IAM"></a>IAM

Part of the [REST API v2 Reference](/docs/api-v2).

Operations about Identity and Access Management.

#### Endpoints

-   [Authenticate a subscriber](#tag/IAM/operation/authenticate-subscriber) — `POST /projects/{project_id}/apps/{app_id}/authenticate`

## <a id="tag/IAM/operation/authenticate-subscriber"></a>Authenticate a subscriber

post/projects/{project_id}/apps/{app_id}/authenticate

https://api.revenuecat.com/v2/projects/{project_id}/apps/{app_id}/authenticate

Issues a short-lived RevenueCat access token for the given `app_user_id`, scoped to the app. The token authenticates the subscriber and is not backed by an IAM user; no id token or refresh token is returned. This endpoint requires the following permission(s): `iam:authorization:issue_token`. This endpoint belongs to the **Iam** domain, which has a default rate limit of **60 requests per minute**.

##### Authorizations:

_BearerAuth_

##### path Parameters

- `project_id` (required): string <= 255 characters Example: proj1ab2c3d4 — ID of the project
- `app_id` (required): string <= 255 characters Example: app1ab2c3d4 — ID of the app

##### Request Body schema: application/json

required

- `app_user_id` (required): string [ 1 .. 1500 ] characters — The app user ID of the subscriber to authenticate.

### Responses

**200**

Success. An access token was issued for the subscriber.

**400**

Bad request

**401**

Unauthorized

**403**

Access denied

**404**

Not found

**409**

Conflict

**422**

Unprocessable entity

**423**

Locked

**429**

The request could not be completed because the rate limiting domain for this endpoint is currently at its limit for this project.

**500**

Internal server error

**503**

Internal server error

### Request samples

Content type

application/json

```json
{
  "app_user_id": "19b8de26-77c1-49f1-aa18-019a391603e2"
}
```

### Response samples

Content type

application/json

```json
{
  "object": "authentication",
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNrXzEyMyJ9.eyJzdWIiOiJhcHBfdXNlcl8xMjMifQ.signature",
  "expires_at": 1658399423658
}
```

## <a id="tag/Endpoint-Reference"></a>Endpoint Reference

All API v2 resources, one page each. General concepts (authentication, pagination, rate limits, error handling) live on the [API v2 overview](/docs/api-v2).

-   [App](/docs/api-v2/app) — 7 endpoints
-   [Audience](/docs/api-v2/audience) — 6 endpoints
-   [Audit Log](/docs/api-v2/audit-log) — 1 endpoint
-   [Charts & Metrics](/docs/api-v2/charts-and-metrics) — 4 endpoints
-   [Collaborator](/docs/api-v2/collaborator) — 1 endpoint
-   [Customer](/docs/api-v2/customer) — 12 endpoints
-   [Customer Resources](/docs/api-v2/customer/resources) — 8 endpoints
-   [Discount](/docs/api-v2/discount) — 10 endpoints
-   [Entitlement](/docs/api-v2/entitlement) — 10 endpoints
-   [IAM](/docs/api-v2/iam) — 1 endpoint
-   [Integration](/docs/api-v2/integration) — 5 endpoints
-   [Invoice](/docs/api-v2/invoice) — 2 endpoints
-   [Offering](/docs/api-v2/offering) — 7 endpoints
-   [Package](/docs/api-v2/package) — 8 endpoints
-   [Paywall](/docs/api-v2/paywall) — 5 endpoints
-   [Paywall Fonts & Media](/docs/api-v2/paywall/assets) — 4 endpoints
-   [Paywall Publishing](/docs/api-v2/paywall/publishing) — 7 endpoints
-   [Product](/docs/api-v2/product) — 8 endpoints
-   [Project](/docs/api-v2/project) — 2 endpoints
-   [Purchase](/docs/api-v2/purchase) — 4 endpoints
-   [Subscription](/docs/api-v2/subscription) — 7 endpoints
-   [Subscription Data Model](/docs/api-v2/subscription-data-model) — full schema reference
-   [Subscription Transactions](/docs/api-v2/subscription-transactions) — 2 endpoints
-   [Virtual Currency](/docs/api-v2/virtual-currency) — 7 endpoints

## Response schema reference

Response examples above mirror the rendered API reference. These field definitions come from the same OpenAPI specification.

### Authentication

- Used by `POST /projects/{project_id}/apps/{app_id}/authenticate (200) — Authenticate a subscriber`

- `object` (required): string — one of `authentication`; String representing the object's type. Objects of the same type share the same value. Always has the value `authentication`.
- `access_token` (required): string — A short-lived RevenueCat access token authenticating the given `app_user_id`. Present it as a Bearer token on behalf of the subscriber. It is not backed by an IAM user and cannot be refreshed.
- `expires_at` (required): integer (format: `int64`) — The date when the access token expires, in ms since epoch.