> ## Documentation Index > Fetch the complete documentation index at: https://docs.anycrm.anyreach.ai/llms.txt > Use this file to discover all available pages before exploring further. # Exchange a PAT/Key for an Access Token This is the only unauthenticated endpoint on the core CRM surface, and it has to be: it's the bootstrap that mints the token everything else requires, so it authenticates *with* the `ak_`/`pat_` credential in the body instead of a prior bearer token. (The share-link endpoints under `/public/…` — AnyCard profiles, media reads, shared CX reports — and `GET /health` are unauthenticated too; they're outside this reference.) You should not need to call this yourself: passing the raw key/PAT as your `Authorization: Bearer` header on any other endpoint triggers this exchange transparently. See [How the exchange works](/authentication#how-the-exchange-works) for the mechanism; this page only documents the body/response shape. ### Auth Unauthenticated. The `ak_`/`pat_` credential in the request body *is* the authentication, so no bearer token, scope, or organization context applies. ### Response `200 OK` | Field | Type | Description | | ------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | `access_token` | `string` | Short-lived Logto access token to use as the actual bearer credential for the wrapped request. | | `token_type` | `string` | Always `"Bearer"`. | | `expires_in` | `integer` | Seconds until `access_token` expires. | | `scope` | `string \| null` | Scopes actually granted on the issued token. | | `organization_id` | `string \| null` | The Logto organization the token is scoped to — the key's own org for `ak_`, or the requested `organization_id` for `pat_`. | | `issued_for_pat_id` | `string` | For `ak_` keys, the full internal key id. For `pat_` tokens, the first 15 characters of the raw token (a display-only partial identifier, not a real id). | ### Errors | Status | Cause | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `401 Unauthorized` | Malformed token (no `ak_`/`pat_` prefix, or an `ak_` value missing its `.secret` half), unknown key id, wrong secret, an expired key, or a key whose paired Logto token was separately revoked. | | `403 Forbidden` | An `organization_id` was supplied for a `pat_` token but the issued access token's organization claim doesn't match it. | ## OpenAPI ````yaml POST /pat/exchange openapi: 3.1.0 info: title: anycrm-api version: 0.0.1 servers: [] security: [] tags: - name: Customer Intelligence description: >- Company research and ICP-fit scoring — create a research run, track its progress, and read back scored companies as leads. - name: Outreach description: >- The cold-email management console — domains, mailboxes, and campaigns — as a thin control plane over the SalesForge stack. - name: AnyCard description: >- Authenticated CRUD for AnyCard, the org's digital business-card / lead-capture product. - name: AnyCard Events description: >- Event-attribution analytics for AnyCard — which captured leads converted, broken down by source, owner, and deal. - name: AnyCard Share Links description: >- Unauthenticated endpoints reached by anyone who scans a QR code or opens a shared AnyCard link. - name: AI description: >- A streaming (SSE) AI chat endpoint with account-commit actions it can take on the caller's behalf. - name: Analytics Assistant description: >- The natural-language analytics assistant — a guarded text-to-SQL loop (SSE) that answers ad-hoc questions over the org's CRM data as a least-privilege, read-only database role. - name: Account Readiness description: >- Account Readiness Profiles — AI-scored signals on whether an account is ready for outreach or expansion, computed via a Temporal workflow. - name: Integrations description: >- Pipedream Connect — issuing connect tokens and managing the org's connected third-party accounts. - name: Feedback description: >- User-submitted platform feedback (bug reports, feature requests) — global, not scoped to one organization. - name: Public Media description: >- Unauthenticated image reads for publicly-embeddable assets (card photos, inline email images) — allowlisted by key shape; everything else in the storage bucket stays private. - name: Service Health description: Service liveness. paths: /pat/exchange: post: tags: - PATs summary: Exchange Pat operationId: exchange_pat_pat_exchange_post requestBody: content: application/json: schema: $ref: '#/components/schemas/PatExchangeRequest' required: true responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/PatExchangeResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: PatExchangeRequest: properties: token: type: string title: Token description: >- The raw ak_... or pat_... credential to exchange for a short-lived Logto access token. scope: type: string title: Scope description: Space-delimited OAuth scopes to request on the issued access token. resource: type: string title: Resource description: The API resource/audience the issued access token is for. client_id: type: string title: Client Id description: Logto client id the exchange is performed on behalf of. organization_id: anyOf: - type: string - type: 'null' title: Organization Id description: >- Logto organization id to scope the exchanged token to. Optional here — omitting it still returns a token, with organization_id null — but a pat_ token issued without an org is unusable: REST endpoints reject it with 400 Active organization required and the MCP server rejects it with 401. Normally supplied from the X-Anyreach-Org header. Ignored for ak_ keys, which are already bound to one org. type: object required: - token - scope - resource - client_id title: PatExchangeRequest PatExchangeResponse: properties: access_token: type: string title: Access Token token_type: type: string title: Token Type default: Bearer expires_in: type: integer title: Expires In scope: anyOf: - type: string - type: 'null' title: Scope issued_for_pat_id: type: string title: Issued For Pat Id organization_id: anyOf: - type: string - type: 'null' title: Organization Id type: object required: - access_token - expires_in - issued_for_pat_id title: PatExchangeResponse HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError ````