v1

latestOpenAPI 3.1.02026-07-26261466.6 KB

Platform connect

Exchange the code for credentials

Exchanges the one-time code from the redirect for the connected organization's API credentials. Single use: a second call with the same code fails. Codes expire 10 minutes after issuance and can only be exchanged by the exact OAuth client that created the session.

Store the returned client_id + client_secret server-side, then mint access tokens with POST /api/v2/oauth/token to act on the organization's behalf.

The exchange is one-shot. The code is consumed the moment the exchange succeeds server-side — if your process loses the response (timeout, crash), a retry returns invalid_code and the credentials are unretrievable; the company must run the connect flow again. Persist the response before acking.

post/api/v2/platform_connect_sessions/{session_id}/exchange

Path parameters

session_idstring required

Request body

codestring required

The code query parameter from the redirect to your return_url.

Response

The connected organization's credentials. The secret is shown only here — store it now.

objectstring

client_idstring

client_secretstring

Store securely server-side. Shown only in this response.

mode'sandbox' | 'production'

test_modeboolean

Example response

{
  "object": "platform_connect_credentials"
}