Switch tenant

Move a signed-in user to another tenant of the same org without signing in again.

POST /oauth/token

Moves a signed-in user to another tenant of the same org without signing in again. Returns a new access and refresh token pair; the previous session is revoked.

A console token switches between orgs the same way: pass an org_… id from GET /organizations as tenant_id.

Authorization

Authorization: Bearer <access token>, the current one. This is the only grant that takes a Bearer token. No client authentication.

Body

Form-encoded (application/x-www-form-urlencoded).

Field	Type	Required	Description
`grant_type`	string	Yes	`urn:loginwith:params:oauth:grant-type:switch-tenant`
`tenant_id`	string	Yes	A tenant the user can enter, which is anything `GET /tenants` lists, and not the one they are already in.

Response

200, with Cache-Control: no-store.

{
  "token_type": "Bearer",
  "access_token": "eyJ…",
  "expires_in": 3600,
  "refresh_token": "…"
}

The old session has ended: its refresh token and access tokens stop working at LoginWith.

Errors

Every refusal is 400 with an RFC 6749 code and nothing else.

Status	`error`	When
`400`	`invalid_request`	`tenant_id` is missing, or names the tenant the token already acts in.
`400`	`invalid_grant`	The Bearer token does not authenticate on this org, or the tenant is not available to this user. Whether it exists is deliberately not said.
`400`	`invalid_request`	The host is not an org.
`400`	`unsupported_grant_type`	`grant_type` is not one of the five the endpoint accepts.

Example

curl -X POST https://acme.loginwith.dev/oauth/token \
  -H "Authorization: Bearer eyJ…" \
  -d grant_type=urn:loginwith:params:oauth:grant-type:switch-tenant \
  -d tenant_id=tnt_…