> ## Documentation Index
> Fetch the complete documentation index at: https://developers.reintersect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange an install code

> Trade the code from the install redirect for the install id.

> Reintersect apps are in developer preview. Names and limits can still change before general
> release.

After an admin approves your app on the [install link](/api-reference/install/authorize), exchange the
`code` from your server for the install id and granted scopes. There's no long-lived token: mint
one-hour install tokens with [Create an install token](/api-reference/install/access-tokens) when you
need them.

Send your client ID and secret in the body, which is form-encoded as in OAuth 2.0. Responses carry
`cache-control: no-store`. Each client can make at most 60 exchanges a minute.

## Body

Send `application/x-www-form-urlencoded`.

| Field | Required | Description |
| - | - | - |
| `grant_type` | Yes | `authorization_code`. |
| `code` | Yes | The code from the redirect. |
| `redirect_uri` | Yes | The same `redirect_uri` you sent on the install link. |
| `code_verifier` | Yes | The PKCE verifier, 43 to 128 characters. |
| `client_id` | Yes | Your app's client ID. |
| `client_secret` | Yes | Your app's client secret. Never send it from a browser. |

## Response

| Field | Description |
| - | - |
| `install_id` | The install. Deliveries carry it in the `reintersect-install` header. |
| `workspace_id` | The workspace the app was installed in. |
| `scope` | The granted scopes, separated by spaces. |

## Errors

| `_tag` | Status | Fields | Cause |
| - | - | - | - |
| `ReintersectAppOAuthInvalidClientError` | 401 | `error: "invalid_client"`, `error_description` | Wrong client ID or secret. |
| `ReintersectAppOAuthInvalidGrantError` | 400 | `error: "invalid_grant"`, `error_description` | Unknown, expired or used code, different `redirect_uri`, or a verifier that doesn't match. |
| `ReintersectApiRateLimitExceededError` | 429 | | Too many exchanges. |

## Example

```bash theme={null}
curl -X POST https://api.reintersect.com/v0/apps/oauth/token \
  -H "content-type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=authorization_code" \
  --data-urlencode "code=$CODE" \
  --data-urlencode "redirect_uri=https://tasks.example.com/reintersect/callback" \
  --data-urlencode "code_verifier=$CODE_VERIFIER" \
  --data-urlencode "client_id=$REINTERSECT_APP_CLIENT_ID" \
  --data-urlencode "client_secret=$REINTERSECT_APP_CLIENT_SECRET"
```

```json theme={null}
{ "install_id": "inst_01J9Z5M2", "workspace_id": "org_01H8XK", "scope": "blocks:write replies:write" }
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.