> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qash.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange token (removed)

> Formerly exchanged a pre-registered userId for a Qash user JWT. Replaced by email OTP login.

<Warning>
  **This endpoint has been removed from the Partner API gateway.**

  Financial and card endpoints still require a QASH user access token — that hasn't changed. What changed is how you get one: instead of exchanging a bare `userId` for a token, the user now proves control of their email with a one-time code.

  Use [Send login code](/api-reference/users/send-otp) and [Verify login code](/api-reference/users/verify-otp) instead. See the [Partner Integration Guide](/guides/partner-integration) for the full current flow.
</Warning>

This page is retained for reference only. There is no longer any HTTP route for this — gateway or service-internal. The underlying token-issuance logic was refactored into an internal helper that is now only invoked as part of the OTP verify flow (`POST /partner/auth/verify`), not reachable on its own with a bare `userId`.

***

## What replaced it

Previously, partners exchanged a `userId` directly for a JWT, with no proof that the request came from the actual end-user:

```
POST /api/v1/partner/auth/token  (userId only)  →  { accessToken }
```

Now, login is a two-step, email-verified exchange:

```
POST /api/v1/partner/auth/send    (email)          →  code emailed to the user
POST /api/v1/partner/auth/verify  (email + code)    →  { accessToken, refreshToken }
```

`X-Api-Key` + `X-Api-Secret` are still required on both calls — your partner scope is unchanged. What's new is that the resulting `accessToken` can only be minted once the user has entered a code sent to an email they control, and only once their account is `active` (KYC approved). Everything downstream — profile updates after login, financial operations, and card issuance — uses that `accessToken` as a standard `Authorization: Bearer` header, not your API key.

***

## Original reference (archived)

```http theme={null}
POST /api/v1/partner/auth/token
X-Api-Key: <your-api-key>
X-Api-Secret: <your-api-secret>
Content-Type: application/json
```

```json theme={null}
{
  "userId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
```

| Field    | Type   | Required | Description                                            |
| -------- | ------ | -------- | ------------------------------------------------------ |
| `userId` | string | Yes      | The Qash user ID returned when the user was registered |