---
title: "Partner token endpoint"
method: POST
path: "/oauth/partner/token"
tags: ["partner-oauth"]
---

# Partner token endpoint

`POST /oauth/partner/token`

Supports grant_type=authorization_code (PKCE S256 required) and grant_type=refresh_token (rotation on every use). Confidential clients authenticate with HTTP Basic or client_secret_post.

## Response `200`

Access token response

- object
  - `access_token` string
  - `expires_in` integer
  - `refresh_token` string
  - `scope` string
  - `token_type` string

## Other responses

- `400` — invalid_request / invalid_grant / invalid_scope / unsupported_grant_type
- `401` — invalid_client

---

[API](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server.md) · [All operations](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/rxfoodapp/inneranalytics-mnt-server/revisions/0703cbbbefe8/schema)