> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revcenter.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Finish a login

> Trade a sign-in for a key, returned once. A browser sign-in sends grant_type authorization_code with the code from the loopback redirect, its PKCE code_verifier and the same redirect_uri. A device login polls with device_code: authorization_pending (or slow_down) until someone authorizes it at /oauth/device. Errors: access_denied, expired_token, invalid_grant. No key needed. Does not use shortlist credits.



## OpenAPI

````yaml /openapi.json post /auth/token
openapi: 3.1.0
info:
  title: Revcenter API
  version: v1
  description: >-
    Projects, searches, scored candidates and shortlists. Generated from the
    agent API's registry.
servers:
  - url: https://api.revcenter.ai/v1
security:
  - bearer: []
tags:
  - name: Login
  - name: Account
  - name: Actions
  - name: Reference
  - name: Projects
  - name: Searches
  - name: Scoring
  - name: Shortlists
  - name: Candidates
  - name: Health
paths:
  /auth/token:
    post:
      tags:
        - Login
      summary: Finish a login
      description: >-
        Trade a sign-in for a key, returned once. A browser sign-in sends
        grant_type authorization_code with the code from the loopback redirect,
        its PKCE code_verifier and the same redirect_uri. A device login polls
        with device_code: authorization_pending (or slow_down) until someone
        authorizes it at /oauth/device. Errors: access_denied, expired_token,
        invalid_grant. No key needed. Does not use shortlist credits.
      operationId: finish_login
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  enum:
                    - authorization_code
                    - device_code
                  description: >-
                    authorization_code for a browser sign-in; omit (or
                    device_code) to poll a device login.
                code:
                  type: string
                  description: The rvca_ code the browser brought to redirect_uri.
                code_verifier:
                  type: string
                  description: >-
                    The PKCE verifier whose S256 challenge opened
                    /oauth/authorize.
                redirect_uri:
                  type: string
                  description: The loopback address the code was sent to, exactly.
                device_code:
                  type: string
                  description: From POST /auth/device.
            example:
              grant_type: authorization_code
              code: rvca_Qm9...
              code_verifier: dBjftJeZ4CVP...
              redirect_uri: http://127.0.0.1:54157/callback
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/LoginKey'
                  meta:
                    $ref: '#/components/schemas/Meta'
              example:
                data:
                  api_key: rvc_live_...
                  key:
                    id: 8d5f0c1e-6a2b-4f3c-9d1e-7b6a5c4d3e21
                    name: revcenter CLI on laptop
                    prefix: rvc_live_RZnk
                    expires_at: '2027-01-15T00:00:00.000Z'
                  workspace:
                    id: org_2xAmpLe
                    name: Acme Search Partners
                meta:
                  request_id: req_01JABCDEF
        '400':
          $ref: '#/components/responses/Error'
        '403':
          $ref: '#/components/responses/Error'
        '429':
          $ref: '#/components/responses/Error'
      security: []
components:
  schemas:
    LoginKey:
      type: object
      properties:
        api_key:
          type: string
          description: The new key, shown once. Store it; never print it.
        key:
          type: object
          properties:
            id:
              type: string
            name:
              type: string
            prefix:
              type: string
            expires_at:
              type:
                - string
                - 'null'
        workspace:
          type: object
          properties:
            id:
              type: string
            name:
              type:
                - string
                - 'null'
    Meta:
      type: object
      properties:
        request_id:
          type: string
        total:
          type: integer
          description: On lists that count everything that matched.
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - request_id
          properties:
            code:
              type: string
              description: 'Stable: every code is on the Errors page.'
            message:
              type: string
            details:
              type:
                - object
                - 'null'
              description: >-
                Structured specifics, when there are any (for example
                retry_after_seconds).
            request_id:
              type: string
        meta:
          $ref: '#/components/schemas/Meta'
      example:
        error:
          code: search_not_found
          message: No search with that id in this workspace.
          details: null
          request_id: req_01JABCDEF
        meta:
          request_id: req_01JABCDEF
  responses:
    Error:
      description: 'An error: one envelope everywhere. A 429 carries Retry-After.'
      headers:
        X-RateLimit-Limit:
          description: >-
            Requests allowed this minute (the tighter of the key's and the
            workspace's).
          schema:
            type: integer
        X-RateLimit-Remaining:
          description: Requests left this minute.
          schema:
            type: integer
        X-RateLimit-Reset:
          description: When the minute resets, in Unix seconds.
          schema:
            type: integer
        Retry-After:
          description: Seconds to wait (on 429 and 503).
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: An API key from Settings → Usage → API (rvc_live_…).

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.