Step 5 · Per-user data (optional)

The steps so far give you a copilot that knows who is asking. If you also want it to read that user's private data — their invoices, their orders — you expose one server-to-server endpoint that trades the user's verified token for a short-lived, scoped access token.

The flow is doubly authenticated: NAVI's gateway calls your endpoint with its own API key and the user's JWT. You verify both, then return a least-privilege token scoped to that one user:

POST /oauth/exchange
  Header:  X-Navi-Api-Key: <shared secret — proves it's NAVI>
  Body:    { "token": "<the user's JWT>" }

// you: verify the API key, verify the JWT (RS256, iss, aud),
// then return a scoped, short-lived token for THAT user only
  → { "access_token": "…", "subdomain": "acme-trading", "expires_in": 600 }

Your data API then requires that token, bound to the user's subdomain, so a token minted for one workspace can never read another's. Configure the endpoint URL, caller auth and scope/TTL under Token Exchange in the Portal.