> ## Documentation Index > Fetch the complete documentation index at: https://docs.agentcard.sh/llms.txt > Use this file to discover all available pages before exploring further. # Exchange the code > Exchanges the one-time `code` from the redirect for the connected organization's API credentials. Single use: a second call with the same code fails. Codes expire 10 minutes after issuance and can only be exchanged by the exact OAuth client that created the session. Store the returned `client_id` + `client_secret` server-side, then mint access tokens with [`POST /api/v2/oauth/token`](/companies/api/reference/create-access-token) to act on the organization's behalf. **The exchange is one-shot.** The code is consumed the moment the exchange succeeds server-side — if your process loses the response (timeout, crash), a retry returns `invalid_code` and the credentials are unretrievable; the company must run the connect flow again. Persist the response before acking. ## OpenAPI ````yaml openapi.json POST /api/v2/platform_connect_sessions/{session_id}/exchange openapi: 3.1.0 info: title: Agentcard API version: 2.0.0 description: >- The Agentcard v2 API — connect your users and verify their identity from your own backend. Every call is authenticated with a platform access token minted from your `client_id` + `client_secret`. servers: - url: https://api.agentcard.sh description: >- There is one base URL. Sandbox vs production is decided by the client credential you use, never by the host. security: - platformToken: [] tags: - name: Authentication description: >- Exchange your client credentials for a platform access token, and introspect what a token acts as. - name: Connect description: >- Connect a user to your platform: send a one-time code, verify it, record consent, and keep the connection alive. - name: Identity verification description: >- Verify a connected user's identity: upload their ID, submit any extra fields we ask for, then show a short face scan. - name: Wallet funding description: >- Fund a connected user's wallet from your own UI — request a payment link, relay the phone verification code, and poll until the funds land. - name: Withdrawals description: >- Move money out of a connected user's wallet — to a saved bank account or a crypto address on Base. Transfers are processed manually by the Agentcard team, usually within 1-3 business days. paths: /api/v2/platform_connect_sessions/{session_id}/exchange: post: tags: - Platform connect summary: Exchange the code for credentials description: >- Exchanges the one-time `code` from the redirect for the connected organization's API credentials. Single use: a second call with the same code fails. Codes expire 10 minutes after issuance and can only be exchanged by the exact OAuth client that created the session. Store the returned `client_id` + `client_secret` server-side, then mint access tokens with [`POST /api/v2/oauth/token`](/companies/api/reference/create-access-token) to act on the organization's behalf. **The exchange is one-shot.** The code is consumed the moment the exchange succeeds server-side — if your process loses the response (timeout, crash), a retry returns `invalid_code` and the credentials are unretrievable; the company must run the connect flow again. Persist the response before acking. operationId: platformConnectExchange parameters: - name: session_id in: path required: true schema: type: string requestBody: required: true content: application/json: schema: type: object required: - code properties: code: type: string description: >- The `code` query parameter from the redirect to your `return_url`. example: code: pcc_6d2f… responses: '200': description: >- The connected organization's credentials. The secret is shown only here — store it now. content: application/json: schema: type: object properties: object: type: string example: platform_connect_credentials organization: type: object properties: id: type: string name: type: string client_id: type: string client_secret: type: string description: Store securely server-side. Shown only in this response. mode: type: string enum: - sandbox - production deprecated: true test_mode: type: boolean '400': description: >- The code is invalid, expired, or already used (`invalid_code`), or you authenticated with an API key instead of client credentials (`client_credentials_required`). content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Missing or invalid bearer token. content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Your organization is no longer enabled as a platform (`platform_not_enabled`). content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: Error: type: object description: Every v2 error uses the same envelope. properties: error: type: object properties: code: type: string description: A stable, machine-readable string (snake_case). Branch on this. message: type: string description: A human-readable explanation, safe to log. docs: type: string description: A link back to the reference. field_errors: type: object additionalProperties: type: string description: Only on `invalid_fields` — names each field to fix. warnings: type: array items: type: string description: >- Only on document upload errors — actionable feedback safe to show the user. securitySchemes: platformToken: type: http scheme: bearer description: >- A platform access token. Get one on the **Create an access token** endpoint by exchanging your `client_id` + `client_secret`, then send it as `Authorization: Bearer `. Tokens live one hour. ````