# AssumeRoleWithCustomToken

LLMS index: [llms.txt](/llms.txt)

---

<a id="assumerolewithcustomtoken"></a>
<a id="minio-sts-assumerolewithcustomtoken"></a>

The MinIO Security Token Service (STS) `AssumeRoleWithCustomToken` API endpoint generates a token for use with the [MinIO External Identity Management Plugin](/administration/identity-access-management/pluggable-authentication/#minio-external-identity-management-plugin).

## Request Endpoint {#request-endpoint}

The `AssumeRoleWithCustomToken` endpoint has the following form:

```shell
POST https://minio.example.net?Action=AssumeRoleWithCustomToken[&ARGS]
```

The following example uses all supported arguments. Replace the `minio.example.net` hostname with the appropriate URL for your MinIO cluster:

```shell
POST https://minio.example.net?Action=AssumeRoleWithCustomToken
&Token=TOKEN
&Version=2011-06-15
&DurationSeconds=86000
&RoleArn="external-auth-provider"
```

### Request Query Parameters {#request-query-parameters}

This endpoint supports the following query parameters:

<table>
  <thead>
    <tr>
      <th><p>Parameter</p></th>
      <th><p>Type</p></th>
      <th><p>Description</p></th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td><p><code>Token</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Required</em></p><p>Specify the JSON Token to present to the external identity manager.
MinIO expects the identity manager to parse the token and determine whether to authenticate client requests using that token.</p></td>
    </tr>
    <tr>
      <td><p><code>Version</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Required</em></p><p>Specify <code>2011-06-15</code>.</p></td>
    </tr>
    <tr>
      <td><p><code>RoleArn</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Required</em></p><p>Specify the ARN for the Identity Manager Plugin configuration to associate with this STS request.</p><p>See <a href="/reference/minio-server/settings/iam/minio-identity-plugin/#envvar.MINIO_IDENTITY_PLUGIN_ROLE_ID"><code>MINIO_IDENTITY_PLUGIN_ROLE_ID</code></a> or <a href="/reference/minio-server/settings/iam/minio-identity-plugin/#mc-conf.identity_plugin.role_id"><code>identity_plugin role_id</code></a> for more information.</p><p>Note that MinIO automatically prepends <code>idmp-</code> to a configured <code>ROLE_ID</code> when generating the RoleArn.
Include that string with the <code>ROLE_ID</code> if required.</p></td>
    </tr>
    <tr>
      <td><p><code>DurationSeconds</code></p></td>
      <td><p>integer</p></td>
      <td><p><em>Optional</em></p><p>Specify the number of seconds after which the temporary credentials expire.
Defaults to <code>3600</code>.</p><ul><li><p>The minimum value is <code>900</code> or 15 minutes.</p></li><li><p>The maximum value is <code>604800</code> or 7 days.</p></li></ul></td>
    </tr>
  </tbody>
</table>

## Response Elements {#response-elements}

MinIO returns an `AssumeRoleWithCustomTokenResult` object, where the `AssumedRoleUser.Credentials` object contains the temporary credentials generated by MinIO:

- `AccessKeyId` - The access key applications use for authentication.
- `SecretKeyId` - The secret key applications use for authentication.
- `Expiration` - The <a id="index-0"></a>[**RFC3339**](https://datatracker.ietf.org/doc/html/rfc3339.html) date and time after which the credentials expire.
- `SessionToken` - The session token applications use for authentication. Some SDKs may require this field when using temporary credentials.

The following example is similar to the response returned by the MinIO STS `AssumeRoleWithCustomToken` endpoint:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<AssumeRoleWithCustomTokenResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
<AssumeRoleWithCustomTokenResult>
   <Credentials>
      <AccessKeyId>ACCESS_KEY</AccessKeyId>
      <SecretAccessKey>SECRET_KEY</SecretAccessKey>
      <Expiration>YYYY-MM-DDTHH:MM:SSZ</Expiration>
      <SessionToken>TOKEN</SessionToken>
   </Credentials>
   <AssumedUser>custom:Alice</AssumedUser>
</AssumeRoleWithCustomTokenResult>
<ResponseMetadata>
   <RequestId>UNIQUE_ID</RequestId>
</ResponseMetadata>
</AssumeRoleWithCustomTokenResponse>
```

## Error Elements {#error-elements}

The XML error response for this API endpoint is similar to the AWS [AssumeRoleWithWebIdentity response](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors).