---
title: "Exchange Partner Token"
method: POST
path: "/v1/partner/oauth/token"
tags: ["partner"]
---

# Exchange Partner Token

`POST /v1/partner/oauth/token`

Exchange an authorization code (with its PKCE code_verifier) or a refresh token for a new access and refresh token pair. Accepts form-encoded or JSON bodies. Refresh tokens are single use: each refresh returns a new pair and revokes the previous access token. Reusing a consumed refresh token revokes the whole connection and requires re-authorization by a practice admin.

## Request body

- PartnerTokenRequest — Token request. Send as application/x-www-form-urlencoded or application/json. Fields beyond grant_type, client_id, and client_secret depend on the grant type.
  - `grant_type` 'authorization_code' | 'refresh_token', required
  - `client_id` string, required — Your partner app's OAuth client ID.
  - `client_secret` string, required — Your partner app's OAuth client secret. Server-side only.
  - `code` string — Authorization code from the consent callback. Required for grant_type=authorization_code. Single use, expires after 5 minutes.
  - `redirect_uri` string — Must exactly match the registered redirect URI. Required for grant_type=authorization_code.
  - `code_verifier` string — PKCE code verifier whose S256 challenge was sent to the consent page. Required for grant_type=authorization_code.
  - `refresh_token` string — Current refresh token. Required for grant_type=refresh_token. Single use — a new pair is returned.

## Response `200`

New token pair. The access token lasts 1 hour, the refresh token 90 days.

- PartnerTokenResponse
  - `access_token` string, required — Opaque bearer token for partner endpoints. Valid for 1 hour.
  - `refresh_token` string, required — Single-use refresh token. Valid for 90 days.
  - `token_type` 'Bearer', required
  - `expires_in` integer, required — Access token lifetime in seconds (3600).

## Other responses

- `400` — Invalid code, verifier, redirect_uri, or grant_type.
- `401` — Invalid client credentials, or invalid, reused, or expired refresh token.

## Changes

- **2026-07-06** `667e3a14dd18` — 1 info
  - endpoint added
- **2026-03-16** `9695d93a926b` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/everbility/apis/everbility-public-api/changes/v1/partner/oauth/token/post.md)

---

[API](https://skmtc.dev/everbility/apis/everbility-public-api.md) · [All operations](https://skmtc.dev/everbility/apis/everbility-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/everbility/everbility-public-api/revisions/0d4efb7914d1/schema)