---
title: "Get OAuth access token"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Get OAuth access token

`POST /oauth/token`

Generates a short-lived JWT bearer token for accessing the Customer API on behalf of a specific client.

**How It Works:**
1. Authenticate with your referral partner API key (XApiKey header)
2. Provide the externalTenantId of the client you want to access
3. Receive a Bearer token valid for 30 minutes
4. Use the token in the Customer API: `Authorization: Bearer {access_token}`

**Requirements:**
- The externalTenantId must match an active ReferralPartnerClientLink for your partner account
- The client must be fully onboarded (SDCA signed)

**Token Details:**
- Type: Bearer (JWT)
- Lifetime: 30 minutes
- Scope: Customer API access for the specified client only

**Usage Example:**
```
POST /oauth/token
{ "externalTenantId": "your-client-id" }

Response:
{ "accessToken": "eyJ...", "tokenType": "Bearer", "expiresIn": 1800 }
```

## Request body

- DebituraWebReferralPartnerApiModelsAccessTokensCreateAccessTokenRequest — Request to generate a short-lived access token for accessing the Customer API on behalf of a linked client.
  - `externalTenantId` string, required — The partner's external identifier for the client/tenant. This must match an active ReferralPartnerClientLink.

## Response `200`

Token generated successfully

- DebituraWebReferralPartnerApiModelsAccessTokensAccessTokenResponse — Response containing a short-lived JWT bearer token for accessing the Customer API.
  - `accessToken` string, nullable — The JWT bearer token to use in Authorization header. Format: "Bearer {access_token}"
  - `expiresIn` integer — Token lifetime in seconds (typically 1800 for 30 minutes).
  - `creditorId` string, uuid — The Debitura creditor ID that this token grants access to.
  - `externalTenantId` string, nullable — The partner's external tenant ID for reference.
  - `tokenType` string, nullable — Token type - always "Bearer" for JWT tokens.

## Other responses

- `400` — Invalid request (missing or invalid externalTenantId)
- `404` — Client not found (no active client link found for externalTenantId)
- `500` — Internal server error

---

[API](https://skmtc.net/debitura/apis/debitura-referral-partner-api.md) · [All operations](https://skmtc.net/debitura/apis/debitura-referral-partner-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/debitura/debitura-referral-partner-api/revisions/2ef555606fd9/schema)