> ## Documentation Index
> Fetch the complete documentation index at: https://docs.korve.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange Session

> Consume a one-time edge-minted login context and exchange the verified Korve user session for a scoped application access token. API clients send `x-korve-access-token: <token>`; Authorization remains reserved for customer application auth. Browsers submit the token to the server-returned callback; the edge responds 303 with `__Host-korve_access=<encoded token>; HttpOnly; Secure; SameSite=Lax; Path=/` and no Domain attribute. The central API never trusts browser callback, project, or scope parameters and never sets a cross-origin cookie.



## OpenAPI

````yaml /openapi.json post /v1/app-access/sessions/exchange
openapi: 3.1.0
info:
  title: Korve API
  version: 0.1.0
  description: >-
    Typed control plane for deploying applications and explicitly provisioning
    their managed infrastructure.
servers:
  - url: https://api.korve.dev
security: []
paths:
  /v1/app-access/sessions/exchange:
    post:
      tags:
        - appAccess
      summary: Exchange Session
      description: >-
        Consume a one-time edge-minted login context and exchange the verified
        Korve user session for a scoped application access token. API clients
        send `x-korve-access-token: <token>`; Authorization remains reserved for
        customer application auth. Browsers submit the token to the
        server-returned callback; the edge responds 303 with
        `__Host-korve_access=<encoded token>; HttpOnly; Secure; SameSite=Lax;
        Path=/` and no Domain attribute. The central API never trusts browser
        callback, project, or scope parameters and never sets a cross-origin
        cookie.
      operationId: appAccess.exchangeSession
      parameters: []
      requestBody:
        required: true
        x-korve-max-bytes: 1048576
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                context:
                  type: string
                  minLength: 32
                  maxLength: 512
                ttlSeconds:
                  type: integer
                  minimum: 300
                  maximum: 604800
              required:
                - context
      responses:
        '201':
          description: Session metadata plus a one-time bearer/cookie token.
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                properties:
                  session:
                    type: object
                    properties:
                      id:
                        type: string
                        format: uuid
                      viewerUserId:
                        type: string
                      email:
                        type: string
                        format: email
                      environment:
                        type:
                          - string
                          - 'null'
                      previewId:
                        type:
                          - string
                          - 'null'
                        format: uuid
                      expiresAt:
                        type: string
                        format: date-time
                      policyVersion:
                        type: integer
                        minimum: 1
                      revokedAt:
                        type:
                          - string
                          - 'null'
                        format: date-time
                      createdAt:
                        type: string
                        format: date-time
                    required:
                      - id
                      - viewerUserId
                      - email
                      - environment
                      - previewId
                      - expiresAt
                      - policyVersion
                      - revokedAt
                      - createdAt
                  token:
                    type: string
                    minLength: 32
                  cookieName:
                    type: string
                    enum:
                      - __Host-korve_access
                  handoff:
                    type: object
                    additionalProperties: false
                    properties:
                      callback:
                        type: string
                        format: uri
                      returnTo:
                        type: string
                    required:
                      - callback
                      - returnTo
                required:
                  - session
                  - token
                  - cookieName
                  - handoff
        '403':
          description: The viewer does not satisfy the effective access mode.
        '404':
          description: Login context is invalid, expired, consumed, or unavailable.
        '422':
          description: The requested scope or lifetime is invalid.
        '503':
          description: Application access enforcement is not ready.
      security:
        - session: []
components:
  securitySchemes:
    session:
      type: apiKey
      in: cookie
      name: korve.session_token

````