# Get a customer portal sign-in token

```http
PATCH https://secure.yoprint.com/v1/api/store/{team_slug}/customer/{hash_id}/token_exchange
```

- Status: internal: built for YoPrint's own apps, don't build on it
- API version: v1
- Operation ID: `v1_public_customer_token_exchange`
- Section: Customers › [Customers](https://developer.yoprint.com/reference/customers.md)
- Web page: https://developer.yoprint.com/reference/customers/v1-customer-token-exchange/
- Authentication: `Authorization: Bearer YOUR_API_KEY`

> **Internal.** Built for YoPrint's own apps, not for integrations. Don't build on it; use the other operations in this section.

This is a credential: don't log or share it. Returns `auth_token`, a sign-in token that opens the Customer Portal as this customer. Built for YoPrint's web app ("view as customer").

## Permission

Needs the Manage Customers permission. At "Manage Assigned to User" only customers assigned to you are allowed; other customers answer 403.

## Path parameters

- `team_slug` (string, required): Your team slug, shown as Team ID next to your API key in Profile. Example `your-team`.
- `hash_id` (string, required): The customer's id (`id` from List customers or Create a customer). A hash id from an earlier answer; unique keys and document numbers (such as `PO0042`) don't work here. Example `EDhVUaC6jbLbed`.

## Request body

This operation takes no request body.

### Example request

```bash
curl -X PATCH 'https://secure.yoprint.com/v1/api/store/your-team/customer/EDhVUaC6jbLbed/token_exchange' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'X-Yoprint-Decimal-Format: exact-v1'
```

## Response

`200` Successful response.

Fields:

- `data` (object, required)
  - `auth_token` (string, required): This is a credential: don't log or share it. A sign-in token for the Customer Portal.
- `status` (integer, required)
- `success` (boolean, required)

Example response:

```json
{
  "data": {
    "auth_token": "CUSTOMER_PORTAL_TOKEN"
  },
  "status": 200,
  "success": true
}
```

## Errors

- `401` The API key is missing or wrong (`unauthenticated`).
- `403` You are not allowed to do this. `api_access_not_in_plan`: your team's plan doesn't include API access (Pro and above, with an active subscription or trial), so every request answers this until the team upgrades. When your role lacks the permission the operation needs, the body is only `{"message": "Insufficient Permission"}`. Other refusals use the error envelope, with `unauthorized` or `user_is_not_authorized`.
  - When: Your role has no Manage Customers permission, or it manages only customers assigned to you and this one is not. This 403 has a short body, `{"message": "You do not have permission to view customer"}`. Fix: Ask for Manage Customers "Manage All", or to be assigned to the customer.
- `404` Not found. `page_not_found`: the team slug is unknown, you are not a member of the team, or an id in the path is not one of this team's. `code: null`, with a message that starts "No query results for": there is no record with that id.
- `500` A business rule refused the request (see the operation's errors), or something failed inside YoPrint. Refusals use the error envelope with a code such as `action_not_allowed`; an unexpected failure answers `{"message": "Server Error"}`. Repeating a refusal gets the same answer; after an unexpected failure, read the record back before you retry a change.
  - When: No live customer with this id in the team; a deleted customer answers the same. This route answers HTTP 500 with `error.code` `invalid` and `error.message` "Invalid Token.". Fix: Check the id.

## Notes

- The token opens the portal even while the Customer Portal is off for the customer (`customer_portal_enabled: false`).

## Related

- [Get a customer](https://developer.yoprint.com/reference/customers/v1-customer-show.md): `GET /v1/api/store/{team_slug}/customer/{hash_id}`