Finish signing in with a provider

POST

/api/v1/auth/exchange

curl --request POST \
  --url http://localhost:8080/api/v1/auth/exchange \
  --header 'Content-Type: application/json' \
  --data '{ "code": "example", "codeVerifier": "example", "device": "example" }'

Trades the one-time code from the redirect, and the PKCE verifier the sign-in started with, for a session. Each code works once, even when the verifier is wrong. A code from linking links the provider account to the user who started it and returns that user without a token.

Someone signing in for the first time gets an account only when the provider allows it (CHEK_OIDC_<ID>_CREATE_USERS); otherwise they link the provider from an account they already have.

Request Body^required

Media typeapplication/json

object

code

required

string

codeVerifier

required

string

device

A label for this session, such as “Living room iPad”.

string

Example ^generated

{
  "code": "example",
  "codeVerifier": "example",
  "device": "example"
}

Responses

200

Signed in, or linked.

Media typeapplication/json

object

token

Send as Authorization: Bearer <token>. Absent after linking.

string

user

required

object

id

required

integer format: int64

name

required

string

role

required

string

Allowed values: admin reader

libraryIds

required

Libraries a reader may open. Empty for admins, who see every library.

Array<integer>

createdAt

required

string format: date-time

demo

True on /api/v1/me for a shared demo account, which can’t change its settings. Absent otherwise.

boolean

Example

{
  "user": {
    "role": "admin"
  }
}

400

The request was malformed.

Media typeapplication/json

object

code

required

string

Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal

message

required

Explains the problem to a developer.

string

Example

{
  "code": "bad_request"
}

403

No account is linked to this provider account, and the provider doesn’t create accounts (not_linked).

Media typeapplication/json

object

code

required

string

Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal

message

required

Explains the problem to a developer.

string

Example

{
  "code": "bad_request"
}

409

The provider account is linked to someone else, or this user already has another account at the provider (identity_taken).

Media typeapplication/json

object

code

required

string

Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal

message

required

Explains the problem to a developer.

string

Example

{
  "code": "bad_request"
}

500

The server failed; details are in its log.

Media typeapplication/json

object

code

required

string

Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal

message

required

Explains the problem to a developer.

string

Example

{
  "code": "bad_request"
}