Exchange the attempt
One-time collection of the user’s connection after they verified (you’ll know from the connection.created webhook, which carries onboarding_attempt_id). Returns the same token pair connect/verify would have: store access_token, refresh_token, and user.id, and keep the session alive with POST /api/v2/connect/refresh. Only the client that created the attempt can exchange it, and only once.
How it works
After the user verifies (theconnection.created webhook tells you), exchange
the attempt once for the connection: the same access_token, refresh_token,
and user.id that connect/verify returns. Store all three and refresh with
POST /api/v2/connect/refresh;
the user never sees a code again.
Only the client that created the attempt can exchange it, and only once. A
409 not_converted means the user hasn’t verified yet; a
410 already_exchanged means you already collected the pair, so use the
tokens you stored.Authorizations
A platform access token. Get one on the Create an access token endpoint by exchanging your client_id + client_secret, then send it as Authorization: Bearer <token>. Tokens live one hour.
Path Parameters
The attempt id from the create response.
Response
The connection. Store the token pair and user.id.

