ai.newnal.illi.account.exchangeCode

illi-service.newnal.id

Documentation

Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events. The code is bound to the code_challenge the app sent when it started the sign-in; codeVerifier proves it is the same app (PKCE-style S256), which stops a code obtained for another account from being injected into the app.

main procedure

Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events. The code is bound to the code_challenge the app sent when it started the sign-in; codeVerifier proves it is the same app (PKCE-style S256), which stops a code obtained for another account from being injected into the app.

Input

Encodingapplication/json
code string Required

No description available.

maxLength: 128 bytes
codeVerifier string Required

The random secret (RFC 7636 code verifier: 43-128 characters of A-Z a-z 0-9 - . _ ~) whose base64url(SHA-256) the app sent as code_challenge to /oauth/login or account.parent.startOAuth.

maxLength: 128 bytesminLength: 43 bytes

Output

Encodingapplication/json
app string Required

No description available.

Known values: family, device
did stringdid Required

A decentralized identifier (DID).

expiresAt stringdatetime Required

An RFC 3339 formatted timestamp.

token string Required

No description available.

Errors

InvalidCode
RateLimitExceeded
Try It

Requests are sent directly from your browser. Some servers may block requests due to CORS.

Base URL for XRPC calls (e.g., https://bsky.social)
Enter valid JSON for the request body
View raw schema 
{
  "description": "Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events. The code is bound to the code_challenge the app sent when it started the sign-in; codeVerifier proves it is the same app (PKCE-style S256), which stops a code obtained for another account from being injected into the app.",
  "errors": [
    {
      "name": "InvalidCode"
    },
    {
      "name": "RateLimitExceeded"
    }
  ],
  "input": {
    "encoding": "application/json",
    "schema": {
      "properties": {
        "code": {
          "maxLength": 128,
          "type": "string"
        },
        "codeVerifier": {
          "description": "The random secret (RFC 7636 code verifier: 43-128 characters of A-Z a-z 0-9 - . _ ~) whose base64url(SHA-256) the app sent as code_challenge to /oauth/login or account.parent.startOAuth.",
          "maxLength": 128,
          "minLength": 43,
          "type": "string"
        }
      },
      "required": [
        "code",
        "codeVerifier"
      ],
      "type": "object"
    }
  },
  "output": {
    "encoding": "application/json",
    "schema": {
      "properties": {
        "app": {
          "knownValues": [
            "family",
            "device"
          ],
          "type": "string"
        },
        "did": {
          "format": "did",
          "type": "string"
        },
        "expiresAt": {
          "format": "datetime",
          "type": "string"
        },
        "token": {
          "type": "string"
        }
      },
      "required": [
        "token",
        "did",
        "app",
        "expiresAt"
      ],
      "type": "object"
    }
  },
  "type": "procedure"
}

Lexicon Garden

@