---
title: "Exchange CLI auth code for API token"
method: POST
path: "/auth/cli/exchange"
tags: ["Authentication"]
---

# Exchange CLI auth code for API token

`POST /auth/cli/exchange`

## Request

- Base URL: `https://kovatools.com/api/v1`
- URL: `https://kovatools.com/api/v1/auth/cli/exchange`
- Auth: none required

Exchanges a one-time authorization code (from the browser auth flow) and a
PKCE code_verifier for a new API token. No Bearer token required.

## Request body

- object
  - `code` string, required: One-time authorization code from browser callback
  - `code_verifier` string, required: PKCE code verifier (plain, SHA-256 of this must match the code_challenge)
  - `state` string, required: State value from browser callback, must match original login state

## Response `201`

Token issued

- object
  - `auth` object
    - `token` string: Raw API token (shown once)
    - `user_email` string
    - `token_prefix` string
    - `created_at` string, date-time
  - `meta` Meta
    - `request_id` string: Unique request identifier for debugging
    - `timestamp` string, date-time

## Other responses

- `401`: Invalid, expired, or already used authorization code
- `422`: Missing required parameters

---

[API](https://skmtc.dev/kovatools/apis/kova-api.md) · [All operations](https://skmtc.dev/kovatools/apis/kova-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kovatools/apis/kova-api/revisions/915eb7ffe3b6?raw)