Exchange the code
Exchanges the one-time code from the return redirect for the connected organization’s client_id + client_secret. The code alone resolves the session (standard OAuth token-endpoint shape) — no session id to track. Call it with the SAME platform credential that created the session, within 10 minutes of completion. One shot: the secret is returned only here; persist both before treating the exchange as done.
POST /api/v2/platform_connect_sessions/{session_id}/exchange remains supported and behaves identically.
Authorizations
A platform access token. Get one on the Create an access token endpoint by exchanging your client_id + client_secret, then send it as Authorization: Bearer <token>. Tokens live one hour.
Body
The code query parameter from the redirect to your return_url.
Response
The connected organization's credentials. The secret is shown only here — store it now.