Exchange a PAT/Key for an Access Token

POST /pat/exchange

Exchange Pat

cURL

curl --request POST \
  --url https://api.example.com/pat/exchange \
  --header 'Content-Type: application/json' \
  --data '
{
  "token": "<string>",
  "scope": "<string>",
  "resource": "<string>",
  "client_id": "<string>",
  "organization_id": "<string>"
}
'

200

{
  "access_token": "<string>",
  "expires_in": 123,
  "issued_for_pat_id": "<string>",
  "token_type": "Bearer",
  "scope": "<string>",
  "organization_id": "<string>"
}

This is the only unauthenticated endpoint on the core CRM surface, and it has to be: it’s the bootstrap that mints the token everything else requires, so it authenticates with the ak_/pat_ credential in the body instead of a prior bearer token. (The share-link endpoints under /public/… — AnyCard profiles, media reads, shared CX reports — and GET /health are unauthenticated too; they’re outside this reference.) You should not need to call this yourself: passing the raw key/PAT as your Authorization: Bearer header on any other endpoint triggers this exchange transparently. See How the exchange works for the mechanism; this page only documents the body/response shape.

Auth

Unauthenticated. The ak_/pat_ credential in the request body is the authentication, so no bearer token, scope, or organization context applies.

Response

200 OK

Field	Type	Description
access_token	string	Short-lived Logto access token to use as the actual bearer credential for the wrapped request.
token_type	string	Always "Bearer".
expires_in	integer	Seconds until access_token expires.
scope	string | null	Scopes actually granted on the issued token.
organization_id	string | null	The Logto organization the token is scoped to — the key’s own org for ak_, or the requested organization_id for pat_.
issued_for_pat_id	string	For ak_ keys, the full internal key id. For pat_ tokens, the first 15 characters of the raw token (a display-only partial identifier, not a real id).

Errors

Status	Cause
401 Unauthorized	Malformed token (no ak_/pat_ prefix, or an ak_ value missing its .secret half), unknown key id, wrong secret, an expired key, or a key whose paired Logto token was separately revoked.
403 Forbidden	An organization_id was supplied for a pat_ token but the issued access token’s organization claim doesn’t match it.

Body

application/json

token · string · required

The raw ak_... or pat_... credential to exchange for a short-lived Logto access token.

scope · string · required

Space-delimited OAuth scopes to request on the issued access token.

resource · string · required

The API resource/audience the issued access token is for.

client_id · string · required

Logto client id the exchange is performed on behalf of.

organization_id · string | null

Logto organization id to scope the exchanged token to. Optional here — omitting it still returns a token, with organization_id null — but a pat_ token issued without an org is unusable: REST endpoints reject it with 400 Active organization required and the MCP server rejects it with 401. Normally supplied from the X-Anyreach-Org header. Ignored for ak_ keys, which are already bound to one org.

Response

200

application/json

Successful Response

access_token · string · required

expires_in · integer · required

issued_for_pat_id · string · required

token_type · string · default: Bearer

scope · string | null

organization_id · string | null