# AssumeRoleWithCustomToken

LLMS index: [llms.txt](/llms.txt)

---

<a id="assumerolewithcustomtoken"></a>
<a id="minio-sts-assumerolewithcustomtoken"></a>

The MinIO Security Token Service (STS) `AssumeRoleWithCustomToken` API endpoint exchanges a token validated by the [MinIO External Identity Management Plugin](/administration/identity-access-management/pluggable-authentication/#minio-external-identity-management-plugin) for temporary S3 credentials.

## Request Endpoint {#request-endpoint}

The `AssumeRoleWithCustomToken` endpoint has the following form:

```shell
POST https://minio.example.net?Action=AssumeRoleWithCustomToken[&ARGS]
```

The following example uses all supported arguments. Replace the `minio.example.net` hostname with the appropriate URL for your MinIO cluster:

```shell
POST https://minio.example.net?Action=AssumeRoleWithCustomToken
&Token=TOKEN
&Version=2011-06-15
&DurationSeconds=86000
&RoleArn=ROLE_ARN_FROM_PLUGIN_CONFIGURATION
```

### Request Query Parameters {#request-query-parameters}

This endpoint supports the following query parameters:

<table>
  <thead>
    <tr>
      <th><p>Parameter</p></th>
      <th><p>Type</p></th>
      <th><p>Description</p></th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td><p><code>Token</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Required</em></p><p>Specify the JSON Token to present to the external identity manager.
MinIO expects the identity manager to parse the token and determine whether to authenticate client requests using that token.</p></td>
    </tr>
    <tr>
      <td><p><code>Version</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Required</em></p><p>Specify <code>2011-06-15</code>.</p></td>
    </tr>
    <tr>
      <td><p><code>RoleArn</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Required</em></p><p>Specify the ARN for the Identity Manager Plugin configuration to associate with this STS request.</p><p>See <a href="/reference/minio-server/settings/iam/minio-identity-plugin/#envvar.MINIO_IDENTITY_PLUGIN_ROLE_ID"><code>MINIO_IDENTITY_PLUGIN_ROLE_ID</code></a> or <a href="/reference/minio-server/settings/iam/minio-identity-plugin/#mc-conf.identity_plugin.role_id"><code>identity_plugin role_id</code></a> for more information.</p><p>Note that MinIO automatically prepends <code>idmp-</code> to a configured <code>ROLE_ID</code> when generating the RoleArn.
Include that string with the <code>ROLE_ID</code> if required.</p></td>
    </tr>
    <tr>
      <td><p><code>DurationSeconds</code></p></td>
      <td><p>integer</p></td>
      <td><p><em>Optional</em></p><p>Specify the number of seconds after which the temporary credentials expire.
If omitted, SILO uses the identity plugin's <code>maxValiditySeconds</code>. If supplied, the effective duration is the smaller of this request and the plugin limit. The plugin must return a limit between <code>900</code> and <code>31536000</code> seconds (15 minutes to 365 days). There is no fixed one-hour default for this endpoint. Request a positive duration suitable for the application.</p></td>
    </tr>
  </tbody>
</table>

## Response Elements {#response-elements}

MinIO returns an `AssumeRoleWithCustomTokenResult` object, where the `Credentials` object contains the temporary credentials generated by MinIO:

- `AccessKeyId` - The access key applications use for authentication.
- `SecretAccessKey` - The secret key applications use for authentication.
- `Expiration` - The <a id="index-0" data-td-print-local></a>[**RFC3339**](https://datatracker.ietf.org/doc/html/rfc3339.html) date and time after which the credentials expire.
- `SessionToken` - Required with the access key and secret key when signing S3 requests with these temporary credentials.

The following example is similar to the response returned by the MinIO STS `AssumeRoleWithCustomToken` endpoint:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<AssumeRoleWithCustomTokenResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
<AssumeRoleWithCustomTokenResult>
   <Credentials>
      <AccessKeyId>ACCESS_KEY</AccessKeyId>
      <SecretAccessKey>SECRET_KEY</SecretAccessKey>
      <Expiration>YYYY-MM-DDTHH:MM:SSZ</Expiration>
      <SessionToken>TOKEN</SessionToken>
   </Credentials>
   <AssumedUser>custom:Alice</AssumedUser>
</AssumeRoleWithCustomTokenResult>
<ResponseMetadata>
   <RequestId>UNIQUE_ID</RequestId>
</ResponseMetadata>
</AssumeRoleWithCustomTokenResponse>
```

## Error Elements {#error-elements}

The XML error response for this API endpoint is similar to the AWS [AssumeRoleWithWebIdentity response](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors).