# ai.newnal.illi.account.exchangeCode

> Published by [illi-service.newnal.id](https://lexicon.garden/identity/did:plc:uztm7bi2ce42dez3uu3qafro)

✓ This is the authoritative definition for this NSID.

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.account.exchangeCode)
- [Documentation](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.account.exchangeCode/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:uztm7bi2ce42dez3uu3qafro/ai.newnal.illi.account.exchangeCode/examples)

## Definitions

### `ai.newnal.illi.account.exchangeCode`

**Type**: `procedure`

Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events. The code is bound to the code_challenge the app sent when it started the sign-in; codeVerifier proves it is the same app (PKCE-style S256), which stops a code obtained for another account from being injected into the app.

#### Input

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `code` | `string` | Yes |  |
| `codeVerifier` | `string` | Yes | The random secret (RFC 7636 code verifier: 43-128 characters of A-Z a-z 0-9 - . _ ~) whose base64url(SHA-256) the app sent as code_challenge to /oauth/login or account.parent.startOAuth. |

#### Output

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `app` | `string` | Yes |  |
| `did` | `string` (did) | Yes |  |
| `expiresAt` | `string` (datetime) | Yes |  |
| `token` | `string` | Yes |  |

#### Errors

- **InvalidCode**
- **RateLimitExceeded**

## Raw Schema

```json
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events. The code is bound to the code_challenge the app sent when it started the sign-in; codeVerifier proves it is the same app (PKCE-style S256), which stops a code obtained for another account from being injected into the app.",
      "errors": [
        {
          "name": "InvalidCode"
        },
        {
          "name": "RateLimitExceeded"
        }
      ],
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "code": {
              "maxLength": 128,
              "type": "string"
            },
            "codeVerifier": {
              "description": "The random secret (RFC 7636 code verifier: 43-128 characters of A-Z a-z 0-9 - . _ ~) whose base64url(SHA-256) the app sent as code_challenge to /oauth/login or account.parent.startOAuth.",
              "maxLength": 128,
              "minLength": 43,
              "type": "string"
            }
          },
          "required": [
            "code",
            "codeVerifier"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "app": {
              "knownValues": [
                "family",
                "device"
              ],
              "type": "string"
            },
            "did": {
              "format": "did",
              "type": "string"
            },
            "expiresAt": {
              "format": "datetime",
              "type": "string"
            },
            "token": {
              "type": "string"
            }
          },
          "required": [
            "token",
            "did",
            "app",
            "expiresAt"
          ],
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "ai.newnal.illi.account.exchangeCode",
  "lexicon": 1
}
```