Exchange Partner JWT
Exchange a partner JWT for a local JWT token that can be used to access protected endpoints. **Partner Integration Guide:** 1. Obtain a valid JWT from your partner token issuer 2. Send the partner token in the request body 3. Receive a local JWT token in response 4. Use the local JWT token in Authorization header for subsequent API calls **Error Troubleshooting:** - `INVALID_TOKEN`: Token format or content is invalid - `TOKEN_EXPIRED`: Partner token has expired - `INVALID_TOKEN_SIGNATURE`: Token signature verification failed - `UNKNOWN_TOKEN_ISSUER`: Organization issuer is not recognized - `MALFORMED_TOKEN`: Token structure is malformed - `INVALID_TOKEN_CLAIMS`: Required token claims are missing or invalid
Request Body
application/json
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/exchange" \ -H "Content-Type: application/json" \ -d '{ "partner_token": "string" }'Successful Exchange
{ "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "token_type": "Bearer", "expires_in": 3600}Invalid Token
{ "code": "INVALID_TOKEN", "description": "The provided token is invalid"}Unauthorized
{ "code": "UNAUTHORISED", "description": "Authentication credentials are missing or invalid"}Forbidden
{ "code": "FORBIDDEN", "description": "Access denied to token exchange endpoint"}Internal Error
{ "code": "INTERNAL_ERROR", "description": "An unexpected error occurred"}Get app settings GET
Get application settings including minimum supported version
Exchange Firebase Phone Number Verification token POST
Exchange a Firebase Phone Number Verification (PNV) JWT for a Cowdi custom token. **Flow:** 1. Client completes phone verification via Firebase PNV SDK 2. Send the PNV JWT to this endpoint 3. Receive a Cowdi custom token (one-time use) 4. Sign in with the custom token via `/v1/auth/sign-in` to obtain ID + refresh tokens The PNV token's `sub` claim must contain the verified E.164 phone number. If a Cowdi user with that phone exists, they are signed in. Otherwise a new user is provisioned on the waiting list.