---
title: "OAuth 2.0 Token Exchange"
method: POST
path: "/authenticate/partner/token-exchange"
tags: ["OAuth"]
---

# OAuth 2.0 Token Exchange

`POST /authenticate/partner/token-exchange`

Implements RFC 8693 (OAuth 2.0 Token Exchange) with extensions.

Validates a partner access token and exchanges it for a JWT token. This implementation uses the requested_subject field (common extension to RFC 8693) to specify the platform user ID for whom the token is being requested.

**Security considerations:**
- Uses HTTPS in production (enforced by infrastructure)
- Validates partner access token
- Generates cryptographically secure JWT tokens

**Grant Type:**
- Only `urn:ietf:params:oauth:grant-type:token-exchange` grant type is supported

**Authentication:**
- This endpoint does NOT require a bearer token
- Authentication is performed using the subject_token in the request body

## Request body

- UserServicePartnerTokenexchangeBody
  - `grant_type` 'urn:ietf:params:oauth:grant-type:token-exchange', required — OAuth 2.0 grant type (must be "urn:ietf:params:oauth:grant-type:token-exchange")
  - `subject_token` string, required — The partner access token to be exchanged
  - `subject_token_type` 'urn:ietf:params:oauth:token-type:access_token', required — Token type (must be "urn:ietf:params:oauth:token-type:access_token")
  - `requested_subject` string, required — The platform user ID for whom the token is being requested (extension field)
  - `scope` 'ADMIN' | 'MANAGER' | 'PAYROLL_ADMIN' | 'BILLING_ADMIN' | 'HR_ADMIN' | 'IT_ADMIN' — User scope/role for access permissions

## Response `200`

Token exchanged successfully

- UserServiceInlineResponse200
  - `access_token` string, required — The access token (JWT) to use for authenticated requests
  - `token_type` 'Bearer', required — Token type (always "Bearer")
  - `expires_in` integer, required — Token expiration time in seconds
  - `refresh_token` string — The refresh token (only included for token-exchange endpoint)
  - `customer_user_id` string — The customer user ID (UUID). Included when a user was auto-provisioned.

## Other responses

- `400` — Bad Request - Validation failed
- `401` — Invalid partner token
- `500` — Internal Server Error - Unexpected server error

---

[API](https://skmtc.net/usemultiplier/apis/multiplier-public-rest-api.md) · [All operations](https://skmtc.net/usemultiplier/apis/multiplier-public-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/usemultiplier/multiplier-public-rest-api/revisions/59cd6443fdbf/schema)