---
title: "Exchange a Canada staff session for a US Bearer"
method: POST
path: "/auth/staff-region-token"
tags: ["internal"]
---

# Exchange a Canada staff session for a US Bearer

`POST /auth/staff-region-token`

Canada-logged-in chef / data_reviewer receives a short-lived US oauth2_token. Auditor must store that token on a separate US HTTP client. A US 401 must not clear Canada auth_info. Canada access_token stays invalid on US.

## Request body

- StaffRegionTokenRequest
  - `region` 'us', required

## Response `200`

US Bearer for this staff user.id

- StaffRegionTokenResponse
  - `access_token` string, required
  - `expires_in` integer, required
  - `region` 'us', required
  - `token_type` string, required
  - `user_id` integer, required

## Other responses

- `400` — region is not us
- `403` — not staff, or not an RxFood email
- `409` — US already has this id or email for someone else

## Changes

- **2026-09-24** `a61b77b30e63` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/changes/auth/staff-region-token/post.md)

---

[API](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server.md) · [All operations](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/llms.txt) · [OpenAPI document](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/revisions/750cc0d96a93?raw)