---
title: "OAuth 2.0 Authorization Code Exchange"
method: POST
path: "/authenticate/partner/authcode"
tags: ["Magic Links"]
---

# OAuth 2.0 Authorization Code Exchange

`POST /authenticate/partner/authcode`

Implements RFC 6749 Section 4.1.3 - Authorization Code Grant.

Exchanges an authorization code for access and refresh tokens.

**Security considerations:**
- Uses HTTPS in production (enforced by infrastructure)
- Auth code is single-use and short-lived
- Validates client_id

**Grant Type:**
- Only `authorization_code` grant type is supported

**Authentication:**
- This endpoint does NOT require a bearer token
- Authentication is performed using the authorization code

## Headers

- `platform` object

## Request body

- UserServicePartnerAuthcodeBody
  - `grant_type` 'authorization_code', required — OAuth 2.0 grant type (must be "authorization_code")
  - `code` string, required — The authorization code from the partner
  - `client_id` string, required — The client identifier

## Response `200`

Tokens issued successfully

- UserServiceInlineResponse200
  - `access_token` string, required — The access token (JWT) to use for authenticated requests
  - `token_type` 'Bearer', required — Token type (always "Bearer")
  - `expires_in` integer, required — Token expiration time in seconds
  - `refresh_token` string — The refresh token (only included for token-exchange endpoint)
  - `customer_user_id` string — The customer user ID (UUID). Included when a user was auto-provisioned.

## Other responses

- `400` — Bad Request - Validation failed
- `401` — Invalid authorization code or client credentials
- `500` — Internal Server Error - Unexpected server error

---

[API](https://skmtc.net/usemultiplier/apis/multiplier-public-rest-api.md) · [All operations](https://skmtc.net/usemultiplier/apis/multiplier-public-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/usemultiplier/multiplier-public-rest-api/revisions/59cd6443fdbf/schema)