---
title: "Desktop Exchange"
method: POST
path: "/v1/auth/desktop/exchange"
---

# Desktop Exchange

`POST /v1/auth/desktop/exchange`

## Request

- Base URL: `https://api.app.membase.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.app.membase.ai/v1/auth/desktop/exchange`
- Auth: none declared

Redemption leg, called by the desktop app itself — unauthenticated like the
other /v1/auth/ sign-in endpoints (all of which the rate-limit middleware skips).
One generic failure message on purpose: the caller learns nothing about *why* a
code was refused. The session is a fresh one, not a hand-off of the browser's —
signing out of the browser must not sign out the desktop app.

## Request body

- DesktopExchangeRequest
  - `code` string, required
  - `code_verifier` string, required

## Response `200`

Successful Response

- DesktopSessionView: SessionView plus the raw session credential. The desktop app is not a browser — it cannot read an httpOnly cookie — so the exchange hands it the cookie value ("<session_id>.<secret>") in the body to store in its own keychain.
  - `account_id` string, required
  - `method` string, required
  - `expires_at` string, required
  - `csrf_token` string, required
  - `role` string, nullable
  - `email` string, nullable
  - `display_name` string, nullable
  - `wallet` string, nullable
  - `session_token` string, required

## Other responses

- `422`: Validation Error
- `default`: Error envelope (ADR 0027)

---

[API](https://skmtc.dev/membase/apis/membase-hosted-api.md) · [All operations](https://skmtc.dev/membase/apis/membase-hosted-api/llms.txt) · [OpenAPI document](https://skmtc.dev/membase/apis/membase-hosted-api/revisions/e0ac58cdb320?raw)