Exchange a PAT/Key for an Access Token
ak_/pat_ credential in the body instead of a prior bearer token. (The share-link endpoints under /public/… — AnyCard profiles, media reads, shared CX reports — and GET /health are unauthenticated too; they’re outside this reference.) You should not need to call this yourself: passing the raw key/PAT as your Authorization: Bearer header on any other endpoint triggers this exchange transparently. See How the exchange works for the mechanism; this page only documents the body/response shape.
Auth
Unauthenticated. Theak_/pat_ credential in the request body is the authentication, so no bearer token, scope, or organization context applies.
Response
200 OK
Errors
Body
The raw ak_... or pat_... credential to exchange for a short-lived Logto access token.
Space-delimited OAuth scopes to request on the issued access token.
The API resource/audience the issued access token is for.
Logto client id the exchange is performed on behalf of.
Logto organization id to scope the exchanged token to. Optional here — omitting it still returns a token, with organization_id null — but a pat_ token issued without an org is unusable: REST endpoints reject it with 400 Active organization required and the MCP server rejects it with 401. Normally supplied from the X-Anyreach-Org header. Ignored for ak_ keys, which are already bound to one org.