API ReferenceGeneratedAuth

Exchange an OAuth hand-off code for a session

The provider callback redirects the browser back with a two-minute single-use hand-off code — never a JWT, which in a URL would land in browser history, referrer headers and proxy logs. This trades that code for the real session, and only the app it was minted for may redeem it.

POST
/{appUid}/auth/oauth/exchange

Path Parameters

appUid*string

Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/oauth/exchange" \  -H "Content-Type: application/json" \  -d '{    "code": "stringstringstringstringstringst"  }'
{  "uid": "string",  "email": "user@example.com",  "fname": "string",  "lname": "string",  "status": "string",  "auth": {    "accessToken": "string",    "refreshToken": "string",    "activeOrgUid": "string"  },  "orgUid": "string",  "org": {    "uid": "string",    "name": "string"  }}

Confirm password reset

Completes a password reset with token and new password.

List available sign-in methods

Which doors THIS deployment offers (password, magic link, email OTP, and the configured OAuth providers), plus whether each one may create an account. Unauthenticated so a sign-in page can render before anyone signs in. Describes configuration only — never anything about a particular account, which is what would enable enumeration.