Sign in

v10

latestOpenAPI 3.1.0raw.githubusercontent.com2026-07-21162658.7 KB
partner

Exchange Partner Token

Exchange an authorization code (with its PKCE code_verifier) or a refresh token for a new access and refresh token pair. Accepts form-encoded or JSON bodies. Refresh tokens are single use: each refresh returns a new pair and revokes the previous access token. Reusing a consumed refresh token revokes the whole connection and requires re-authorization by a practice admin.

post/v1/partner/oauth/token

Request body

grant_type'authorization_code' | 'refresh_token' required
client_idstring required

Your partner app's OAuth client ID.

client_secretstring required

Your partner app's OAuth client secret. Server-side only.

codestring

Authorization code from the consent callback. Required for grant_type=authorization_code. Single use, expires after 5 minutes.

redirect_uristring

Must exactly match the registered redirect URI. Required for grant_type=authorization_code.

code_verifierstring

PKCE code verifier whose S256 challenge was sent to the consent page. Required for grant_type=authorization_code.

refresh_tokenstring

Current refresh token. Required for grant_type=refresh_token. Single use — a new pair is returned.

Response

New token pair. The access token lasts 1 hour, the refresh token 90 days.

access_tokenstring required

Opaque bearer token for partner endpoints. Valid for 1 hour.

refresh_tokenstring required

Single-use refresh token. Valid for 90 days.

token_type'Bearer' required
expires_ininteger required

Access token lifetime in seconds (3600).

Example response

{
  "access_token": "pat_Zl9nB1qFhOQe2kQ4rW8xJ3Ty",
  "refresh_token": "prt_M4kQ9wY2eXvB7cJ1sL6pR8Ud",
  "token_type": "Bearer",
  "expires_in": 3600
}