---
title: "Exchange Chutes PKCE auth code for a refresh token (server-side)"
method: POST
path: "/v1/miner/chutes/exchange-code"
tags: ["miner"]
---

# Exchange Chutes PKCE auth code for a refresh token (server-side)

`POST /v1/miner/chutes/exchange-code`

Complete the Chutes OAuth code exchange on behalf of the SDK CLI.

Chutes' OAuth app is registered as a Confidential client (requires
``client_secret`` at /idp/token). The SDK, distributed via PyPI, can't
safely hold a secret. So the SDK runs the browser PKCE leg locally
(preserves auth-code interception protection) and then hands the
resulting authorization code + ``code_verifier`` here. Backend holds
the ``client_secret`` and completes the exchange (ORO-1463).

## Request body

- ExchangeChutesCodeRequest — Request body for ``POST /v1/miner/chutes/exchange-code``. SDK sends this after capturing the auth code from Chutes' redirect. Backend completes the OAuth token exchange server-side (where the ``client_secret`` lives) and persists the resulting refresh_token encrypted under the miner's hotkey.
  - `code` string, required — Authorization code from Chutes /idp/authorize redirect.
  - `code_verifier` string, required — PKCE code_verifier the SDK generated before /idp/authorize. Per RFC 7636: 43–128 characters from the unreserved set [A-Za-z0-9-._~].
  - `redirect_uri` string, required — Must exactly match the redirect_uri the SDK sent to /idp/authorize (per RFC 6749 §4.1.3). Backend validates against an allowlist.

## Response `200`

Successful Response

- ExchangeChutesCodeResponse — Response body for ``POST /v1/miner/chutes/exchange-code``.
  - `ok` boolean, required — True on successful exchange + persistence.
  - `default_provider` string, nullable — Miner's default inference provider after persistence. Set to 'chutes' if this was the miner's first provider connection.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/oroagents/apis/oro-api.md) · [All operations](https://skmtc.dev/oroagents/apis/oro-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/oroagents/oro-api/revisions/38ef86138115/schema)