Auth

Trade a browser authorization for tokens

Second half of the browser authorization flow. A tool opens /authorize in a browser, is redirected back to its own loopback address with a code, and trades that code here for a token pair. Codes are single use and expire within minutes, must be redeemed against the same redirect_uri they were issued for, and must be presented with the code_verifier whose SHA-256 was sent as the code_challenge on the authorization request.

post/api/v1/auth/exchange

Request

  • Base URL: https://session-replay.com
  • URL: https://session-replay.com/api/v1/auth/exchange
  • Auth: none declared

Request body

codestring required

The code the redirect carried back

redirect_uristring required

The loopback address the code was issued for

code_verifierstring required

The secret behind the code_challenge sent to /authorize

Response

tokens issued

Changes

No recorded changes to this operation across all 1 revision of this API.