---
title: "Exchange authorization code for API key"
method: POST
path: "/auth/keys"
tags: ["OAuth"]
---

# Exchange authorization code for API key

`POST /auth/keys`

Exchange an authorization code from the PKCE flow for a user-controlled API key

## Request body

- object
  - `code` string, required — The authorization code received from the OAuth redirect
  - `code_challenge_method` 'S256' | 'plain' | 'null', nullable — The method used to generate the code challenge
  - `code_verifier` string — The code verifier if code_challenge was used in the authorization request

## Response `200`

Successfully exchanged code for an API key

- object
  - `key` string, required — The API key to use for OpenRouter requests
  - `user_id` string, nullable, required — User ID associated with the API key

## Other responses

- `400` — Bad Request - Invalid request parameters or malformed input
- `403` — Forbidden - Authentication successful but insufficient permissions
- `500` — Internal Server Error - Unexpected server error

---

[API](https://skmtc.net/openrouterteam/apis/openrouter-api.md) · [All operations](https://skmtc.net/openrouterteam/apis/openrouter-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openrouterteam/openrouter-api/versions/f3788187f5b7/schema)