---
title: "Trade a browser authorization for tokens"
method: POST
path: "/api/v1/auth/exchange"
tags: ["Auth"]
---

# Trade a browser authorization for tokens

`POST /api/v1/auth/exchange`

## Request

- Base URL: `https://session-replay.com`
- URL: `https://session-replay.com/api/v1/auth/exchange`
- Auth: none declared

Second half of the browser authorization flow. A tool opens /authorize in a browser, is redirected back to its own loopback address with a code, and trades that code here for a token pair. Codes are single use and expire within minutes, must be redeemed against the same redirect_uri they were issued for, and must be presented with the code_verifier whose SHA-256 was sent as the code_challenge on the authorization request.

## Request body

- object
  - `code` string, required: The code the redirect carried back
  - `redirect_uri` string, required: The loopback address the code was issued for
  - `code_verifier` string, required: The secret behind the code_challenge sent to /authorize

## Response `200`

tokens issued

## Other responses

- `400`: code, redirect_uri or code_verifier missing
- `401`: code unknown, expired, already used, issued for another destination, or presented with the wrong verifier

---

[API](https://skmtc.dev/session-replay/apis/session-replay-api.md) · [All operations](https://skmtc.dev/session-replay/apis/session-replay-api/llms.txt) · [OpenAPI document](https://skmtc.dev/session-replay/apis/session-replay-api/revisions/120e5613bf95?raw)