Exchange token (removed)

curl --request POST \
  --url https://api.example.com/api/v1/partner/auth/token

POST

api

partner

auth

token

Exchange token (removed)

curl --request POST \
  --url https://api.example.com/api/v1/partner/auth/token

This endpoint has been removed from the Partner API gateway.Financial and card endpoints still require a QASH user access token — that hasn’t changed. What changed is how you get one: instead of exchanging a bare userId for a token, the user now proves control of their email with a one-time code.Use Send login code and Verify login code instead. See the Partner Integration Guide for the full current flow.

This page is retained for reference only. There is no longer any HTTP route for this — gateway or service-internal. The underlying token-issuance logic was refactored into an internal helper that is now only invoked as part of the OTP verify flow (POST /partner/auth/verify), not reachable on its own with a bare userId.

What replaced it

Previously, partners exchanged a userId directly for a JWT, with no proof that the request came from the actual end-user:

POST /api/v1/partner/auth/token  (userId only)  →  { accessToken }

Now, login is a two-step, email-verified exchange:

POST /api/v1/partner/auth/send    (email)          →  code emailed to the user
POST /api/v1/partner/auth/verify  (email + code)    →  { accessToken, refreshToken }

X-Api-Key + X-Api-Secret are still required on both calls — your partner scope is unchanged. What’s new is that the resulting accessToken can only be minted once the user has entered a code sent to an email they control, and only once their account is active (KYC approved). Everything downstream — profile updates after login, financial operations, and card issuance — uses that accessToken as a standard Authorization: Bearer header, not your API key.

Original reference (archived)

POST /api/v1/partner/auth/token
X-Api-Key: <your-api-key>
X-Api-Secret: <your-api-secret>
Content-Type: application/json

{
  "userId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

Field	Type	Required	Description
`userId`	string	Yes	The Qash user ID returned when the user was registered

Exchange rates / TRM

Cards

Users

Login

User profile

KYC

Account Management

Financials

Exchange token (removed)

What replaced it

Original reference (archived)

​What replaced it

​Original reference (archived)

What replaced it

Original reference (archived)