---
title: "Exchange a hosted sign-in code"
method: POST
path: "/v1/auth/sign-in/exchange"
tags: ["Auth"]
---

# Exchange a hosted sign-in code

`POST /v1/auth/sign-in/exchange`

## Request

- Base URL: `https://api.configure.dev`
- URL: `https://api.configure.dev/v1/auth/sign-in/exchange`
- Auth: API key in header `X-API-Key`

Exchanges a short-lived cfgsic_ code for an agent-scoped token for the acting agent.

## Headers

- `X-Agent` string

## Request body

- SignInExchangeRequest
  - `code` string, required

## Response `200`

Agent-scoped Configure token.

- SignInExchangeResponse
  - `token` string, required: Agent-scoped Configure token for the acting agent.
  - `userId` string, required
  - `tokenUse` 'agent', required
  - `approved` boolean, required
  - `agent` string, required

## Other responses

- `400`: Request shape is invalid.
- `403`: Forbidden. Common causes include secret_key_required, token_wrong_type, approval_required, or access_denied.

---

[API](https://skmtc.dev/configure/apis/configure-http-api.md) · [All operations](https://skmtc.dev/configure/apis/configure-http-api/llms.txt) · [OpenAPI document](https://skmtc.dev/configure/apis/configure-http-api/revisions/ec760a9533d2?raw)