> ## Documentation Index
> Fetch the complete documentation index at: https://swapnice.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth

> Authorization-code + PKCE endpoints for the Partner API.

Use these routes to discover the authorization server, issue a code, exchange it for a token, introspect, and revoke.

The sandbox walkthrough uses **JSON `POST /oauth/authorize`**, then **`POST /oauth/token`**. Do not use a browser OAuth helper that expects a redirect-only authorize URL unless you are building the hosted connect page.

<CardGroup cols={2}>
  <Card title="Authentication guide" icon="key" href="/partners/authentication">
    PKCE, scopes, token lifetime, and common errors.
  </Card>

  <Card title="Request walkthrough" icon="list-ol" href="/partners/request-walkthrough">
    Ordered sandbox calls with copy-paste bodies.
  </Card>
</CardGroup>

## Endpoints in this group

| Method | Path                                                                                | Job                              |
| ------ | ----------------------------------------------------------------------------------- | -------------------------------- |
| `GET`  | [`/.well-known/oauth-authorization-server`](/partners/api-reference/oauth-metadata) | Discovery                        |
| `POST` | [`/oauth/authorize`](/partners/api-reference/oauth-authorize)                       | Issue a code (partner JSON flow) |
| `GET`  | [`/oauth/authorize`](/partners/api-reference/oauth-authorize-browser)               | Browser authorize page           |
| `POST` | [`/oauth/token`](/partners/api-reference/oauth-token)                               | Exchange or refresh              |
| `POST` | [`/oauth/introspect`](/partners/api-reference/oauth-introspect)                     | Inspect a token                  |
| `POST` | [`/oauth/revoke`](/partners/api-reference/oauth-revoke)                             | Revoke a token                   |

Access tokens last about 15 minutes. Authorization codes last about 5 minutes and are single-use. `scope` on authorize is a space-separated string.

Open each route in the sidebar for the playground and full schema.