Skip to the content
Get an API key
  1. API reference
  2. Get started

Exchange a docs sign-in code

POST/public/docs-sessions/exchange
Core + Managed TransfersAuthNo credential

The docs site calls this after the dashboard sent the browser back with #code=…. A code works once and for 2 minutes. The token lives 8 hours. 20 calls per minute per IP.

Request body

application/json · required

code
string
required

Response

200application/json · DocsSessionExchangeAnswerOK
token
string
requiredSend it as Authorization: DocsSession <token>.
expiresAt
date-time
required
account
DocsSessionAccount
required
account.name
string
required
account.slug
string
required
account.clientId
uuid | null
requiredYour oldest live Client ID. Never a Client Secret.
account.returnUrls
string[]
required
account.isEvaluationAccount
boolean
requiredTrue while the account is capped at 5 connected users.
account.isTransferServiceEnabled
boolean
requiredTrue when MusicAPI Managed Transfers is on for the account.
account.enabledIntegrations
string[]
required
Example answer
{
  "token": "string",
  "expiresAt": "2026-10-16T09:41:07.000Z",
  "account": {
    "name": "Acme Music",
    "slug": "acme",
    "clientId": "5b0c6f0e-2c8a-4d0e-9a51-7e3f1c2d9b44",
    "returnUrls": [
      "string"
    ],
    "isEvaluationAccount": true,
    "isTransferServiceEnabled": true,
    "enabledIntegrations": [
      "spotify"
    ]
  }
}

Errors

400

invalidCode: the code is used, expired or unknown.

429

Too many exchanges from this IP.