---
title: "Exchange an auth code for a payment token"
method: POST
path: "/tokenized-payment/v1/link-sessions/token"
tags: ["Account Linking"]
---

# Exchange an auth code for a payment token

`POST /tokenized-payment/v1/link-sessions/token`

Validates the one-time auth code issued after the user completes the ShopBack consent flow and returns a reusable payment token scoped to the merchant channel.

## Request body

- SwapPaymentTokenRequest
  - `code` string, required — The short-lived auth code. Single-use, has TTL.

## Response `200`

- SwapPaymentTokenResponse
  - `paymentToken` string, required — Long-lived opaque token scoped to (merchant, user, country). Re-linking the same user returns the same value.

## Other responses

- `400` — The auth code is missing, the link session is not ready to exchange a code, the auth code has expired, or the auth code is incorrect.
- `401` — Missing or invalid merchant JWT.
- `404` — Link session not found or belongs to a different merchant.

---

[API](https://skmtc.net/shopback/apis/online-payments-api.md) · [All operations](https://skmtc.net/shopback/apis/online-payments-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/shopback/online-payments-api/versions/160fc287769e/schema)