---
title: "Exchange Handoff Code"
method: POST
path: "/api/auth/token/exchange"
tags: ["auth"]
---

# Exchange Handoff Code

`POST /api/auth/token/exchange`

## Request

- Base URL: `https://api.retirementlab.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.retirementlab.app/api/auth/token/exchange`
- Auth: none declared

Exchange a one-time OAuth handoff code for a bearer token.

The mobile app receives the handoff code via deep link and POSTs it here
over HTTPS.  The code is single-use and short-TTL; a reused or expired code
is rejected.  On success a fresh opaque session token is issued — the same
server-side revocable credential as the web cookie.

## Request body

- TokenExchangeRequest: Exchange a one-time OAuth handoff code for a bearer token.
  - `code` string, required

## Response `200`

Successful Response

- TokenResponse: Bearer token issued to a mobile (token-mode) client.
  - `auth_token` string, required
  - `expires_at` string, date-time, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/retirementlab/apis/income-simulator-api.md) · [All operations](https://skmtc.dev/retirementlab/apis/income-simulator-api/llms.txt) · [OpenAPI document](https://skmtc.dev/retirementlab/apis/income-simulator-api/revisions/b0f00a0333fd?raw)