authentication

Exchange a CLI authorization code for a key

Keyless second leg of index365 login --web. Swaps the single-use PKCE authorization code (minted on the dashboard consent screen) plus the PKCE code_verifier for a freshly minted, scoped API key. Unauthenticated by design (the client has no key yet); the code is single-use, short-lived, loopback-bound, and PKCE-S256-bound. Not for manual use - the dashboard API Keys page is how humans create keys.

post/api/v1/cli/token

Request

  • Base URL: https://index365.co
  • URL: https://index365.co/api/v1/cli/token
  • Auth: none required

Request body

codestring required

Single-use authorization code from the loopback callback.

code_verifierstring required

PKCE verifier whose S256 hash is the stored code_challenge.

redirect_uristring required

The exact loopback redirect_uri the CLI registered.

Response

Credential issued. The secret is returned exactly once.

Changes

No recorded changes to this operation across all 1 revision of this API.