# PartnerAuthIngressService

Partners are issued a durable API key, which they authenticate via `ExchangeApiKey`. This returns a short-lived token used as a bearer token on all subsequent requests for that session. The `PartnerAuthIngressService` exposes unauthenticated endpoints; all other services require the auth token, and may also require scope-specific identity headers.

```http
Authorization: Bearer <token>
```

## ExchangeApiKey

Exchanges a Partner API key for a Partner JWT.

```protobuf
service PartnerAuthIngressService {
  rpc ExchangeApiKey(ExchangeApiKeyRequest) returns (ExchangeApiKeyResponse);
}

message ExchangeApiKeyRequest {
  string api_key = 1;
}

message ExchangeApiKeyResponse {
  string auth_token = 1;
  int64 expires_at_ms = 2;
}
```

**REST:** [`POST /v1/partner-rpc/com.basiccapital.systems.ingress.partner.PartnerAuthIngressService/ExchangeApiKey`](/openapi/partnerauthingressservice/exchangeapikey)

## GetSelf

Returns information about the authenticated partner.

```protobuf
service PartnerAuthIngressService {
  rpc GetSelf(GetSelfRequest) returns (GetSelfResponse);
}

message GetSelfRequest {}

message GetSelfResponse {
  string partner_uuid = 1;
  string partner_name = 2;
}
```

**REST:** [`POST /v1/partner-rpc/com.basiccapital.systems.ingress.partner.PartnerAuthIngressService/GetSelf`](/openapi/partnerauthingressservice/getself)