Skip to main content
POST
cURL

Headers

DPoP
string
required

A DPoP proof (RFC 9449) for this request, signed by the device key whose thumbprint the signing was started with.

Body

application/json

The code an app trades for a signing token, with the PKCE verifier and the DPoP proof of the device key the code is bound to.

code
string
required

The code the browser handed back.

Maximum string length: 128
Example:

"7t3uQmP0oXr5fVw0b1s2y9nqJpZcE4kGhA8dLmTn6Rw"

code_verifier
string
required

The PKCE verifier whose S256 hash was the code_challenge.

Required string length: 43 - 128
Example:

"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

Response

SigningTokenResource

data
SigningTokenResource · object
required