---
title: "Exchange the code for credentials"
method: POST
path: "/api/v2/platform_connect_sessions/{session_id}/exchange"
tags: ["Platform connect"]
---

# Exchange the code for credentials

`POST /api/v2/platform_connect_sessions/{session_id}/exchange`

Exchanges the one-time `code` from the redirect for the connected organization's API credentials. Single use: a second call with the same code fails. Codes expire 10 minutes after issuance and can only be exchanged by the exact OAuth client that created the session.

Store the returned `client_id` + `client_secret` server-side, then mint access tokens with [`POST /api/v2/oauth/token`](/companies/api/reference/create-access-token) to act on the organization's behalf.

**The exchange is one-shot.** The code is consumed the moment the exchange succeeds server-side — if your process loses the response (timeout, crash), a retry returns `invalid_code` and the credentials are unretrievable; the company must run the connect flow again. Persist the response before acking.

## Path parameters

- `session_id` string, required

## Request body

- object
  - `code` string, required — The `code` query parameter from the redirect to your `return_url`.

## Response `200`

The connected organization's credentials. The secret is shown only here — store it now.

- object
  - `object` string
  - `organization` object
    - `id` string
    - `name` string
  - `client_id` string
  - `client_secret` string — Store securely server-side. Shown only in this response.
  - `mode` 'sandbox' | 'production'
  - `test_mode` boolean

## Other responses

- `400` — The code is invalid, expired, or already used (`invalid_code`), or you authenticated with an API key instead of client credentials (`client_credentials_required`).
- `401` — Missing or invalid bearer token.
- `403` — Your organization is no longer enabled as a platform (`platform_not_enabled`).

---

[API](https://skmtc.dev/agentcard/apis/agentcard-api.md) · [All operations](https://skmtc.dev/agentcard/apis/agentcard-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/agentcard/agentcard-api/revisions/638d12c8303f/schema)