# Exchange a docs sign-in code
URL: https://musicapi.com/docs/reference/exchange-docs-code.md

`POST https://api.musicapi.com/public/docs-sessions/exchange`

Section: Get started.
Product: MusicAPI Core and MusicAPI Managed Transfers.
Auth: none.

The docs site calls this after the dashboard sent the browser back with `#code=…`. A code works once and for 2 minutes. The token lives 8 hours. 20 calls per minute per IP.

## Request body

`application/json`, required.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | string | yes |  |

## Response 200

OK

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `token` | string | yes | Send it as `Authorization: DocsSession <token>`. |
| `expiresAt` | date-time | yes |  |
| `account` | DocsSessionAccount | yes |  |
| `account.name` | string | yes |  |
| `account.slug` | string | yes |  |
| `account.clientId` | uuid \| null | yes | Your oldest live Client ID. Never a Client Secret. |
| `account.returnUrls` | string[] | yes |  |
| `account.isEvaluationAccount` | boolean | yes | True while the account is capped at 5 connected users. |
| `account.isTransferServiceEnabled` | boolean | yes | True when MusicAPI Managed Transfers is on for the account. |
| `account.enabledIntegrations` | string[] | yes |  |

```json
{
  "token": "string",
  "expiresAt": "2026-10-16T09:41:07.000Z",
  "account": {
    "name": "Acme Music",
    "slug": "acme",
    "clientId": "5b0c6f0e-2c8a-4d0e-9a51-7e3f1c2d9b44",
    "returnUrls": [
      "string"
    ],
    "isEvaluationAccount": true,
    "isTransferServiceEnabled": true,
    "enabledIntegrations": [
      "spotify"
    ]
  }
}
```

## Errors

- 400: `invalidCode`: the code is used, expired or unknown.
- 429: Too many exchanges from this IP.

## Example

```bash
curl -X POST "https://api.musicapi.com/public/docs-sessions/exchange" \
  -H "Content-Type: application/json" \
  -d '{"code":"string"}'
```