---
title: "Exchange a sign-in code"
method: POST
path: "/api/v1/auth/oauth/exchange"
tags: ["Authentication"]
---

# Exchange a sign-in code

`POST /api/v1/auth/oauth/exchange`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/api/v1/auth/oauth/exchange`
- Auth: HTTP bearer

Trades the one-time code the Google sign-in callback put in the dashboard's URL for the same session a password sign-in returns: the access token in the body, the refresh token in its cookie. A code works once, within 60 seconds of the callback, and only in the browser the callback redirected: it must carry the `railhook_signin_handoff` cookie the callback set.

## Cookies

- `railhook_signin_handoff` string

## Request body

- ExchangeSignInCodeRequest
  - `code` string, required

## Response `200`

Signed in

## Other responses

- `401`: The code has been used, has expired, or was opened in another browser
- `429`: Too many requests

---

[API](https://skmtc.dev/railhook/apis/railhook-api.md) · [All operations](https://skmtc.dev/railhook/apis/railhook-api/llms.txt) · [OpenAPI document](https://skmtc.dev/railhook/apis/railhook-api/revisions/4e2c76dfc33d?raw)