Auth

Exchange Sign In Code

Changed on

Exchange a single sign-on code for a browser session.

When the SPA shares the API's origin, an OAuth or SAML callback redirects with a one-time code in the URL fragment instead of setting the refresh cookie. The sign-in page posts that code here, and the response sets the httpOnly refresh cookie and its CSRF cookie the way /auth/login does in cookie mode, with a null refresh_token in the body.

A code is valid once, for two minutes, only from the browser the callback redirected, and only with the nonce the page started the sign-in with. Every refusal is the same 401.

post/auth/oauth/exchange/

Request

  • The document declares no server URL.
  • Auth: none declared

Headers

X-GeoLens-Auth-Modestring nullable

Must be cookie: this call only establishes a browser cookie session.

Request body

codestring required

The one-time code from the code parameter of the sign-in redirect's URL fragment.

noncestring required

The nonce the page sent when it started this sign-in.

Response

Successful Response

access_tokenstring required

JWT access token for Authorization header

refresh_tokenstring nullable required

Opaque token used to obtain a new access token. Always present for programmatic callers (CLI, SDKs, CI). Null when the caller opted into the browser cookie flow with 'X-GeoLens-Auth-Mode: cookie', in which case the token is delivered as an httpOnly cookie instead (GH-1302).

token_typestring
expires_ininteger required

Seconds until the access token expires

Changes