Skip to main content
POST
Exchange Partner Token

Body

Token request. Send as application/x-www-form-urlencoded or application/json. Fields beyond grant_type, client_id, and client_secret depend on the grant type.

grant_type
enum<string>
required
Available options:
authorization_code,
refresh_token
client_id
string
required

Your partner app's OAuth client ID.

client_secret
string
required

Your partner app's OAuth client secret. Server-side only.

code
string

Authorization code from the consent callback. Required for grant_type=authorization_code. Single use, expires after 5 minutes.

redirect_uri
string

Must exactly match the registered redirect URI. Required for grant_type=authorization_code.

code_verifier
string

PKCE code verifier whose S256 challenge was sent to the consent page. Required for grant_type=authorization_code.

Pattern: ^[A-Za-z0-9\-._~]{43,128}$
refresh_token
string

Current refresh token. Required for grant_type=refresh_token. Single use — a new pair is returned.

Response

New token pair. The access token lasts 1 hour, the refresh token 90 days.

access_token
string
required

Opaque bearer token for partner endpoints. Valid for 1 hour.

refresh_token
string
required

Single-use refresh token. Valid for 90 days.

token_type
enum<string>
default:Bearer
required
Available options:
Bearer
expires_in
integer
required

Access token lifetime in seconds (3600).