Exchange Partner Token
Exchange an authorization code (with its PKCE code_verifier) or a refresh token for a new access and refresh token pair. Accepts form-encoded or JSON bodies. Refresh tokens are single use: each refresh returns a new pair and revokes the previous access token. Reusing a consumed refresh token revokes the whole connection and requires re-authorization by a practice admin.
Body
Token request. Send as application/x-www-form-urlencoded or application/json. Fields beyond grant_type, client_id, and client_secret depend on the grant type.
authorization_code, refresh_token Your partner app's OAuth client ID.
Your partner app's OAuth client secret. Server-side only.
Authorization code from the consent callback. Required for grant_type=authorization_code. Single use, expires after 5 minutes.
Must exactly match the registered redirect URI. Required for grant_type=authorization_code.
PKCE code verifier whose S256 challenge was sent to the consent page. Required for grant_type=authorization_code.
^[A-Za-z0-9\-._~]{43,128}$Current refresh token. Required for grant_type=refresh_token. Single use — a new pair is returned.
Response
New token pair. The access token lasts 1 hour, the refresh token 90 days.