> ## Documentation Index
> Fetch the complete documentation index at: https://docs.korve.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange Code

> Consume a one-time authorization code and return a new app session.



## OpenAPI

````yaml /openapi.json post /v1/apps/{projectId}/auth/token
openapi: 3.1.0
info:
  title: Korve API
  version: 0.1.0
  description: >-
    Typed control plane for deploying applications and explicitly provisioning
    their managed infrastructure.
servers:
  - url: https://api.korve.dev
security: []
paths:
  /v1/apps/{projectId}/auth/token:
    post:
      tags:
        - appauth
      summary: Exchange Code
      description: Consume a one-time authorization code and return a new app session.
      operationId: appauth.exchangeCode
      parameters:
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: The project id (UUID) or globally unique project slug.
      requestBody:
        required: true
        x-korve-max-bytes: 1048576
        content:
          application/json:
            schema:
              type: object
              properties:
                code:
                  type: string
              required:
                - code
              additionalProperties: false
      responses:
        '200':
          description: New app session.
          content:
            application/json:
              schema:
                type: object
                properties:
                  accessToken:
                    type: string
                    description: >-
                      Short-lived opaque bearer token. Only a SHA-256 digest is
                      stored by Korve.
                  refreshToken:
                    type: string
                    description: >-
                      One-time rotating token. Only a SHA-256 digest is stored
                      by Korve.
                  expiresAt:
                    type: string
                    format: date-time
                  user:
                    type: object
                    properties:
                      id:
                        type: string
                      email:
                        type: string
                        format: email
                      emailVerified:
                        type: boolean
                      name:
                        type:
                          - string
                          - 'null'
                      image:
                        type:
                          - string
                          - 'null'
                      disabledAt:
                        type:
                          - string
                          - 'null'
                        format: date-time
                      createdAt:
                        type: string
                        format: date-time
                      lastSignInAt:
                        type:
                          - string
                          - 'null'
                        format: date-time
                      lastActiveAt:
                        type:
                          - string
                          - 'null'
                        format: date-time
                    required:
                      - id
                      - email
                      - emailVerified
                      - name
                      - image
                      - disabledAt
                      - createdAt
                      - lastSignInAt
                      - lastActiveAt
                required:
                  - accessToken
                  - refreshToken
                  - expiresAt
                  - user
        '400':
          description: Invalid, expired, or consumed code.
        '429':
          description: Too many token exchanges.
      security: []

````