Exchange token (removed)
curl --request POST \
--url https://api.example.com/api/v1/partner/auth/tokenconst options = {method: 'POST'};
fetch('https://api.example.com/api/v1/partner/auth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.example.com/api/v1/partner/auth/token"
response = requests.post(url)
print(response.text)Login
Exchange token (removed)
Formerly exchanged a pre-registered userId for a Qash user JWT. Replaced by email OTP login.
POST
/
api
/
v1
/
partner
/
auth
/
token
Exchange token (removed)
curl --request POST \
--url https://api.example.com/api/v1/partner/auth/tokenconst options = {method: 'POST'};
fetch('https://api.example.com/api/v1/partner/auth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.example.com/api/v1/partner/auth/token"
response = requests.post(url)
print(response.text)This endpoint has been removed from the Partner API gateway.Financial and card endpoints still require a QASH user access token — that hasn’t changed. What changed is how you get one: instead of exchanging a bare
userId for a token, the user now proves control of their email with a one-time code.Use Send login code and Verify login code instead. See the Partner Integration Guide for the full current flow.POST /partner/auth/verify), not reachable on its own with a bare userId.
What replaced it
Previously, partners exchanged auserId directly for a JWT, with no proof that the request came from the actual end-user:
POST /api/v1/partner/auth/token (userId only) → { accessToken }
POST /api/v1/partner/auth/send (email) → code emailed to the user
POST /api/v1/partner/auth/verify (email + code) → { accessToken, refreshToken }
X-Api-Key + X-Api-Secret are still required on both calls — your partner scope is unchanged. What’s new is that the resulting accessToken can only be minted once the user has entered a code sent to an email they control, and only once their account is active (KYC approved). Everything downstream — profile updates after login, financial operations, and card issuance — uses that accessToken as a standard Authorization: Bearer header, not your API key.
Original reference (archived)
POST /api/v1/partner/auth/token
X-Api-Key: <your-api-key>
X-Api-Secret: <your-api-secret>
Content-Type: application/json
{
"userId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
| Field | Type | Required | Description |
|---|---|---|---|
userId | string | Yes | The Qash user ID returned when the user was registered |