Lexicon Garden

ai.newnal.illi.account.exchangeCode

Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events. The code is bound to the code_challenge the app sent when it started the sign-in; codeVerifier proves it is the same app (PKCE-style S256), which stops a code obtained for another account from being injected into the app.

Repository @illi-service.newnal.id did:plc:uztm7bi2ce42dez3uu3qafro namespace authority
Details · procedure
Kindprocedure
Authorityaccount.illi.newnal.ai
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

code

requiredstring
  • maxLength: 128

codeVerifier

requiredstring

The random secret (RFC 7636 code verifier: 43-128 characters of A-Z a-z 0-9 - . _ ~) whose base64url(SHA-256) the app sent as code_challenge to /oauth/login or account.parent.startOAuth.

  • minLength: 43
  • maxLength: 128

Output

application/json

app

requiredstring
  • knownValues: family | device

did

requiredstring · did

expiresAt

requiredstring · datetime

token

requiredstring

Errors

InvalidCode

No description in schema.

RateLimitExceeded

No description in schema.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • ai.newnal.illi.account.parent.startOAuth

    procedure

    Start a parent's OAuth sign-in on the device through the PDN's own page (BFF), for an existing Newnal ID whose credentials are typed on the PDN page. Device-created accounts, and existing ones whose credentials the device app takes itself, sign in with account.parent.signIn instead. client=native ends with a one-time code on the device app's App Link for account.exchangeCode instead of a cookie.

  • ai.newnal.illi.account.getAttestationNonce

    procedure

    Issue a server nonce (5 minutes) that a client binds into its attestation before calling account.requestPDNCreationGrant, account.parent.signIn, account.family.signIn or device.requestOnboardingCode. The nonce is an attestation session: the attestation bound to it may be presented again for the same client kind and subject until it expires; a failed verification ends the session. Devices put it in the Android key-attestation challenge of a key provisioned through Newnal's RKP; family apps pass i