An app redeems its one-time code for what the register gives it, unauthenticated

authorization_code: the sma_ code with the verifier of its challenge, for the client it was issued to. Every code works once whatever the outcome; a used, expired, unknown or other client's code, or a wrong verifier, is 401. A person in several firms is answered choose_firm with an smp_ handle bound to the client, challenge and device, alive ten minutes, which organization_selection redeems with the same verifier and device and one of the firms offered. workos_code, the desktop only: WorkOS's code from the browser leg with the window's verifier. The device names its platform, which must be one of the client's (400). The desktop requires X-Six-Minute-Page: 1 from an allowed Origin and is answered a session, its refresh token in the page's http-only cookie; the phone refuses any request carrying an Origin (403) and is answered its device credential only. A sign-in is provisioned on the server as POST /v1/me/provision does. A phone's device id of another person is 409; a desktop's, or a revoked one, leaves the session tied to no device, for the engine's enrolment to register the machine. Rate limited per caller.