Exchange the code
Exchanges the one-time code from the redirect for the connected organization’s API credentials. Single use: a second call with the same code fails. Codes expire 10 minutes after issuance and can only be exchanged by the exact OAuth client that created the session.
Store the returned client_id + client_secret server-side, then mint access tokens with POST /api/v2/oauth/token to act on the organization’s behalf.
The exchange is one-shot. The code is consumed the moment the exchange succeeds server-side — if your process loses the response (timeout, crash), a retry returns invalid_code and the credentials are unretrievable; the company must run the connect flow again. Persist the response before acking.
Authorizations
A platform access token. Get one on the Create an access token endpoint by exchanging your client_id + client_secret, then send it as Authorization: Bearer <token>. Tokens live one hour.
Path Parameters
Body
The code query parameter from the redirect to your return_url.
Response
The connected organization's credentials. The secret is shown only here — store it now.