Exchange CLI login code

Unauthenticated exchange: the one-time code plus PKCE verifier is the credential. Returns the agent connection token once, bound to the caller’s workspace with a policy delegated from the parent principal (persistent ancestry enforced server-side). Owner review covers privilege amplification.

POST/v1/cli-login/exchange

Request body

requiredapplication/json

codestringrequired

verifierstringrequired

PKCE verifier.

Responses

200

Successful response

dataCliLoginExchangerequired

Show properties

tokenstringrequired

Agent connection credential; shown once by this response. Store securely, never log or commit.

workspacestringrequired

matches ^[a-f0-9]{64}$

connectionIdstring<uuid>required

expiresAtinteger | nullrequired

accessstringrequired

Allowed:readact

rolestringrequired

Allowed:operatoradministrator

400

Invalid request or validation failure

errorobjectrequired

Show properties

codestringrequired

messagestring

issuesobject[]

Show properties

Array of object

pathstring

messagestring

401

Missing or invalid credential

errorobjectrequired

Show properties

codestringrequired

messagestring

issuesobject[]

Show properties

Array of object

pathstring

messagestring

403

Insufficient access or grant

errorobjectrequired

Show properties

codestringrequired

messagestring

issuesobject[]

Show properties

Array of object

pathstring

messagestring

404

Resource not found

errorobjectrequired

Show properties

codestringrequired

messagestring

issuesobject[]

Show properties

Array of object

pathstring

messagestring

413

Request body exceeds the 16 KiB limit

errorobjectrequired

Show properties

codestringrequired

messagestring

issuesobject[]

Show properties

Array of object

pathstring

messagestring

429

Rate limit or workspace capacity limit

errorobjectrequired

Show properties

codestringrequired

messagestring

issuesobject[]

Show properties

Array of object

pathstring

messagestring

500

Internal error

errorobjectrequired

Show properties

codestringrequired

messagestring

issuesobject[]

Show properties

Array of object

pathstring

messagestring

503

Service or required integration is not configured

errorobjectrequired

Show properties

codestringrequired

messagestring

issuesobject[]

Show properties

Array of object

pathstring

messagestring

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Bodyapplication/json

codestring*verifierstring*PKCE verifier.

Request

curl -X POST 'https://www.openlaunch.dev/v1/cli-login/exchange' \
  -H 'Content-Type: application/json' \
  -d '{
  "code": "string",
  "verifier": "string"
}'

const response: Response = await fetch("https://www.openlaunch.dev/v1/cli-login/exchange", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: "{\n  \"code\": \"string\",\n  \"verifier\": \"string\"\n}"
});

import requests

response = requests.post(
    "https://www.openlaunch.dev/v1/cli-login/exchange",
    headers={
        "Content-Type": "application/json"
    },
    data="{\n  \"code\": \"string\",\n  \"verifier\": \"string\"\n}",
)

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader("{\n  \"code\": \"string\",\n  \"verifier\": \"string\"\n}")
	req, err := http.NewRequest("POST", "https://www.openlaunch.dev/v1/cli-login/exchange", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, _ := io.ReadAll(res.Body)
	fmt.Println(string(data))
}

Response

{
  "data": {
    "token": "string",
    "workspace": "string",
    "connectionId": "84b500d7-71c8-4b1f-adf4-f1eb0000973d",
    "expiresAt": 0,
    "access": "read",
    "role": "operator"
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "issues": [
      {
        "path": "string",
        "message": "string"
      }
    ]
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "issues": [
      {
        "path": "string",
        "message": "string"
      }
    ]
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "issues": [
      {
        "path": "string",
        "message": "string"
      }
    ]
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "issues": [
      {
        "path": "string",
        "message": "string"
      }
    ]
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "issues": [
      {
        "path": "string",
        "message": "string"
      }
    ]
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "issues": [
      {
        "path": "string",
        "message": "string"
      }
    ]
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "issues": [
      {
        "path": "string",
        "message": "string"
      }
    ]
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "issues": [
      {
        "path": "string",
        "message": "string"
      }
    ]
  }
}