Sign in
latestOpenAPI 3.0.1Proprietary2026-08-1844131294.9 KB

59cd6443fdbf

Magic Links

OAuth 2.0 Authorization Code Exchange

Implements RFC 6749 Section 4.1.3 - Authorization Code Grant.

Exchanges an authorization code for access and refresh tokens.

Security considerations:

  • Uses HTTPS in production (enforced by infrastructure)
  • Auth code is single-use and short-lived
  • Validates client_id

Grant Type:

  • Only authorization_code grant type is supported

Authentication:

  • This endpoint does NOT require a bearer token
  • Authentication is performed using the authorization code
post/authenticate/partner/authcode

Headers

platformobject

Optional platform type for refresh token cookie

Request body

grant_type'authorization_code' required

OAuth 2.0 grant type (must be "authorization_code")

codestring required

The authorization code from the partner

client_idstring required

The client identifier

Example request

{
  "grant_type": "authorization_code",
  "code": "abc123def456",
  "client_id": "partner_client_123"
}

Response

Tokens issued successfully

access_tokenstring required

The access token (JWT) to use for authenticated requests

token_type'Bearer' required

Token type (always "Bearer")

expires_ininteger required

Token expiration time in seconds

refresh_tokenstring

The refresh token (only included for token-exchange endpoint)

customer_user_idstring

The customer user ID (UUID). Included when a user was auto-provisioned.

Example response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.refresh...",
  "customer_user_id": "759a086f-48b3-4e34-aefd-00c8a9e68523"
}