POST /v1/extension/exchange
Exchange a Desk one-time code for an API key (Chrome extension sign-in)
Exchange a Desk one-time code for an API key (Chrome extension sign-in)
Desk (Settings > Extension) shows a one-time code valid for 10 minutes. The extension sends it here and receives an API key (named "extension:<device>", scopes read:pricing, read:listings, write:deals) that is shown once. No Authorization header. The key can be revoked in Desk at any time. Attempts are limited service-wide to 60 per minute.
- Authentication: No authentication
openapi.json).Request body
| Field | Type | Required | Description |
|---|---|---|---|
code | string | yes | One-time code from Desk (Settings > Extension), like ABCD-EFGH-JKLM. Valid for 10 minutes. |
device | string | no | Device name shown in Desk, e.g. "Chrome". |
Responses
200
The key and the tenant.
application/json · Schema: ExtensionExchangeResponse
| Field | Type | Required | Description |
|---|---|---|---|
api_key | string | yes | API key rv_live_…; shown once, store it in chrome.storage.local. |
key_prefix | string | yes | |
scopes | string[] | yes | |
tenant | object | yes | |
tenant.id | string (uuid) | yes | |
tenant.slug | string | yes | |
tenant.name | string | yes | |
tenant.plan | "trial" | "starter" | "pro" | "business" | yes | |
tenant.country | string | yes | |
tenant.currency | string | yes | |
tenant.locale | "uk" | "pl" | "en" | yes |
400
Invalid body, or the code is invalid, expired or already used (code invalid_code).
application/problem+json · Schema: Problem
401
Not returned by this endpoint (no Authorization header is used).
application/problem+json · Schema: Problem
403
The user who issued the code no longer has access to the tenant.
application/problem+json · Schema: Problem
429
Rate limit exceeded for the tenant plan (code rate_limited). Wait Retry-After seconds.
application/problem+json · Schema: Problem