sign-in

Trade a one-time sign-in token for a web API key

The web calls this with the token from /signin/callback#t=... after Google sign-in. The token works once, for 60 seconds. The answer is a new API key named "web sign-in" with every scope and a 30-day expiry, the person (user) and where to go next (return_to). An account keeps at most 3 web keys: the oldest is revoked. 409 key_limit_reached when the account already holds the most keys it can and none of them is a web key. Free. Called from the web's own origin, the key is also set in the session cookie, which the web then uses instead (FAILURE_MODES.md WS1).

post/v1/auth/exchange

Request

Base URL: https://api.hookdetector.com (the document declares no server; this is the origin it was published from)
URL: https://api.hookdetector.com/v1/auth/exchange
Auth: none declared

Request body

tokenstring required

the t value of the /signin/callback#t=... fragment

Response

Successful Response

api_keystring required

the web key; shown once, send it as Bearer

key_idstring required

prefixstring required

created_atstring required

expires_atstring required

30 days from now

account_idstring required

return_tostring required

the same-site path to go to next

Example response

{
  "account_id": "8f1c2d3e-4b5a-4c6d-8e7f-9a0b1c2d3e4f",
  "api_key": "hd_...",
  "created_at": "2026-09-23T10:00:00.000000+00:00",
  "expires_at": "2026-09-23T10:00:00.000000+00:00",
  "key_id": "8f1c2d3e-4b5a-4c6d-8e7f-9a0b1c2d3e4f",
  "prefix": "hd_AbCdEfGh",
  "return_to": "/chat",
  "user": {
    "email": "ana@example.com",
    "is_admin": false,
    "name": "Ana"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.