Finish an OAuth sign-in
curl --request POST \
--url https://my.server.express/api/v1/auth/oauth/exchange \
--header 'Content-Type: application/json' \
--data '
{
"code": "<string>",
"state": "<string>"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({code: '<string>', state: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/oauth/exchange', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/oauth/exchange"
payload = {
"code": "<string>",
"state": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT",
"bannedAt": "2023-11-07T05:31:56Z"
}
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Auth
Finish an OAuth sign-in
Called by the portal’s OAuth callback page. Verifies the signed state, swaps the provider’s code for an access token, reads the user’s identity and signs them in. Google creates an account on first sign-in (with the email already confirmed); Discord and Telegram only match an account that’s already linked. If the account has a second factor, returns a pre-auth token instead of a session. Any failure after the state check — provider errors, an unlinked Discord/Telegram account, a banned or throwaway-email account — comes back as 500 carrying the reason. Not rate-limited.
POST
/
v1
/
auth
/
oauth
/
exchange
Finish an OAuth sign-in
curl --request POST \
--url https://my.server.express/api/v1/auth/oauth/exchange \
--header 'Content-Type: application/json' \
--data '
{
"code": "<string>",
"state": "<string>"
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({code: '<string>', state: '<string>'})
};
fetch('https://my.server.express/api/v1/auth/oauth/exchange', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/auth/oauth/exchange"
payload = {
"code": "<string>",
"state": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"accessToken": "<string>",
"refreshToken": "<string>",
"user": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"email": "[email protected]",
"firstName": "<string>",
"lastName": "<string>",
"role": "CLIENT",
"bannedAt": "2023-11-07T05:31:56Z"
}
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Body
application/json