> ## Documentation Index > Fetch the complete documentation index at: https://docs.younegotiate.com/llms.txt > Use this file to discover all available pages before exploring further. # Exchange login handoff > Exchange a short-lived, single-use Superadmin handoff for a non-remembered creditor access and refresh token pair. Invalid, expired, reused, wrong-portal, deleted-user, blocked-user, and deactivated-company handoffs are rejected with the same validation response. ## OpenAPI ````yaml /api/creditor.openapi.yaml post /auth/login-as/exchange openapi: 3.1.0 info: title: YouNegotiate Creditor API version: '2.0' description: >- Stateless API endpoints for creditor portal authentication and account access. servers: - url: https://api.creditor.younegotiate.com description: Production security: [] tags: - name: System description: Public creditor domain system and health endpoints. - name: Authentication description: Creditor registration, login, password, and email verification endpoints. - name: Account Settings description: >- Authenticated creditor profile, contact, operating-hours, and profile-image endpoints. - name: Account Profile description: >- Creditor onboarding profile, membership, billing, and setup status endpoints. - name: Setup Wizard description: >- Creditor setup wizard status, required-step completion, and optional-step completion. - name: Dashboard description: Creditor dashboard work queues and performance widgets. - name: Import / Export description: >- Creditor consumer import upload sessions, queued imports, history, downloads, and failed-row files. - name: Membership Settings description: >- Creditor membership dashboard, plan changes, payment method, cancellation, special-plan inquiry, and over-limit retry endpoints. - name: Merchant Account description: >- Existing merchant processor credentials, Tilled onboarding, and merchant application endpoints. - name: Header Profiles description: >- CSV header profile upload, mapping, download, and setup wizard completion endpoints. - name: SFTP Connections description: >- Creditor-managed SFTP connection profiles for imports, exports, and setup wizard completion. - name: Sub Accounts description: >- Creditor-managed sub account list, export, create, update, and delete endpoints. - name: Pay Terms Offers description: >- Creditor-managed master, sub-account, group, and group-sub-account Pay Terms endpoints. - name: Individual Custom Offers description: Creditor individual custom offer list endpoints. - name: Negotiations description: >- Creditor negotiation work queues, including notice responses and offer review counts. - name: Communications / CFPB Validation Letter description: >- CFPB Validation Letter tables, secure EcoLetter send/resend, CSV export, and print/download actions. - name: Communications / EcoLetter Template description: >- Creditor EcoLetter template management for secure eLetter communications and campaigns. - name: Communications / Groups description: >- Creditor communication group management for dynamic consumer targeting and campaign selection. - name: Communications / Schedule Campaign description: >- Creditor EcoLetter campaign scheduling, quote, immediate send, and delivery queue endpoints. - name: Communications / Campaign Tracker description: >- Creditor campaign tracker reporting, refresh, and consumer export endpoints. - name: Consumer Profiles description: Creditor Consumer Profiles list, filter options, and CSV export endpoints. - name: Terms & Conditions description: Creditor-managed master and sub-account Terms & Conditions templates. - name: About Us & Contact description: Creditor-managed company About Us content shown to consumers. - name: Logo & Links description: >- Creditor-managed master and sub-account personalized logo colors, size, and consumer link metadata. - name: Users description: >- Master creditor user management, invitations, and account deletion endpoints. paths: /auth/login-as/exchange: post: tags: - Authentication summary: Exchange login handoff description: >- Exchange a short-lived, single-use Superadmin handoff for a non-remembered creditor access and refresh token pair. Invalid, expired, reused, wrong-portal, deleted-user, blocked-user, and deactivated-company handoffs are rejected with the same validation response. operationId: creditorExchangeLoginHandoff requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/LoginHandoffExchangeRequest' example: handoff_token: >- 01234567890123456789012345678901234567890123456789012345678901234567890123456789 responses: '200': description: Handoff exchanged and creditor token pair issued. content: application/json: schema: $ref: '#/components/schemas/AuthTokenResponse' example: message: Logged in as creditor. data: id: 42 name: Creditor User email: creditor@example.com meta: access_token: 1|access-token refresh_token: refresh-token token_type: Bearer access_token_expires_at: null refresh_token_expires_at: '2026-07-19T19:00:00.000000Z' '422': $ref: '#/components/responses/ValidationError' '429': $ref: '#/components/responses/TooManyRequests' components: schemas: LoginHandoffExchangeRequest: type: object additionalProperties: false required: - handoff_token properties: handoff_token: type: string minLength: 80 maxLength: 80 description: >- Plaintext handoff received from the Superadmin login-as endpoint. It is single-use and must be exchanged before its expiry timestamp. AuthTokenResponse: type: object required: - message - data - meta properties: message: type: string data: $ref: '#/components/schemas/Creditor' meta: type: object required: - access_token - refresh_token - token_type - access_token_expires_at - refresh_token_expires_at properties: access_token: type: string refresh_token: type: string description: >- Plaintext refresh token returned once. Store securely and send to POST /auth/refresh. token_type: type: string example: Bearer access_token_expires_at: type: - string - 'null' format: date-time description: >- Access token expiry timestamp when an expiry is assigned; otherwise null. refresh_token_expires_at: type: string format: date-time Creditor: type: object description: Creditor user resource returned by the backend. additionalProperties: true properties: id: type: integer name: type: string email: type: string format: email ValidationErrorResponse: type: object required: - message - errors properties: message: type: string errors: type: object additionalProperties: type: array items: type: string MessageResponse: type: object required: - message properties: message: type: string responses: ValidationError: description: Request validation failed. content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' TooManyRequests: description: Rate limit exceeded. content: application/json: schema: $ref: '#/components/schemas/MessageResponse' example: message: Too Many Attempts. ````