---
title: "Exchange a one-time native OIDC handoff code"
method: POST
path: "/auth/oidc/handoff"
tags: ["Auth"]
---

# Exchange a one-time native OIDC handoff code

`POST /auth/oidc/handoff`

## Request

- Base URL: `https://app.openpo.st/api/v1`
- URL: `https://app.openpo.st/api/v1/auth/oidc/handoff`
- Auth: none required

## Request body

- OIDCNativeHandoffInputBody
  - `$schema` string, uri: A URL to the JSON Schema for this object.
  - `code` string, required

## Response `200`

OK

- OIDCNativeHandoffOutputBody
  - `$schema` string, uri: A URL to the JSON Schema for this object.
  - `action` string
  - `purpose` 'login' | 'reauth' | 'link', required
  - `reauth_grant` string
  - `token` string
  - `user` UserProfile
    - `$schema` string, uri: A URL to the JSON Schema for this object.
    - `avatar_url` string, required: Profile avatar URL
    - `composer_experience` 'specialized' | 'unified', required: Preferred composer experience
    - `created_at` string, date-time, required: Account creation time
    - `display_name` string, required: User display name
    - `email` string, required: User email address
    - `email_verified` boolean, required: Whether the account email address is verified
    - `has_password` boolean, required: Whether this account has a local password credential
    - `id` string, required: User ID
    - `is_admin` boolean, required: Whether this user can manage instance-level settings
    - `is_managed` boolean, required: Whether this account was provisioned by an organization identity provider
    - `legal_acceptance_required` boolean, required: Whether the current hosted policy still needs acceptance
    - `legal_accepted_at` string, date-time: When the current account policy was accepted
    - `managed_organization_name` string: Organization managing this account
    - `password_usable` boolean, required: Whether the local password can currently be used for sign-in and sensitive-action reauthentication
    - `privacy_version` string: Privacy version acknowledged by the user
    - `public_profile_enabled` boolean, required: Whether the public activity profile is visible
    - `public_profile_visible_fields` string[], nullable, required: Optional account fields visible while the public profile is enabled
    - `terms_version` string: Terms version accepted by the user
    - `username` string, required: Unique public username

## Other responses

- `400`: Bad Request
- `422`: Unprocessable Entity
- `500`: Internal Server Error

---

[API](https://skmtc.dev/openpo/apis/openpost-api.md) · [All operations](https://skmtc.dev/openpo/apis/openpost-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openpo/apis/openpost-api/revisions/67d3964458a7?raw)