# Exchange related person session code for tokens

Canonical page: https://docs.ovok.com/api/tenant-authentication/exchange-related-person-session-code-for-tokens

`POST /auth/tenant/RelatedPerson/login/token`

Finishes a related person (carer) login: exchanges the session code from `login/start` (or `login/mfa`) and your PKCE `codeVerifier` for an access token and a refresh token.

**Auth:** none. The session code and code verifier prove the earlier steps.

## Behaviour

- Ovok redeems the code with Medplum's `oauth2/token` endpoint (`grant_type=authorization_code`).
- The signed-in profile must be a RelatedPerson. A code for any other profile type is refused.
- The token reads only what patients have shared with the carer: the shared Observation codes and each sharer's record with its contact fields hidden. Practitioner and patient-only routes refuse it with 403.
- If the account was scheduled for deletion (`DELETE /auth/delete`), logging in cancels the deletion.
- The response holds `accessToken`, `refreshToken`, `expiresIn` (seconds) and references to the `project` and `profile`.
- Error responses are delayed to take at least one second.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/auth/tenant/RelatedPerson/login/token' \
  -H 'Content-Type: application/json' \
  -d '{
    "sessionCode": "<sessionCode from login/start>",
    "codeVerifier": "<your codeVerifier>"
  }'
```