> ## Documentation Index
> Fetch the complete documentation index at: https://developer.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.

# Redeem Login Code

> Redeems a one-time OAuth login code and returns the `loginToken` and `userId`. Use these values as the `X-Auth-Token` and `X-User-Id` headers in authenticated requests.

This endpoint does not require authentication. Each code is single-use, expires after 60 seconds, and is limited to 10 redemption requests per minute per caller.

### Changelog
| Version | Description |
| ------- | ----------- |
| 8.7.0   | Added       |

## OpenAPI

````json POST /api/v1/loginCode.redeem
{
  "openapi": "3.0.0",
  "info": {
    "version": "1.0.0",
    "title": "Authentication"
  },
  "servers": [
    {
      "url": "https://apiexplorer.support.rocket.chat"
    }
  ],
  "tags": [
    {
      "name": "Authentication"
    },
    {
      "name": "Two-Factor Authentication"
    }
  ],
  "paths": {
    "/api/v1/loginCode.redeem": {
      "post": {
        "tags": [
          "Authentication"
        ],
        "summary": "Redeem Login Code",
        "description": "Redeems a one-time OAuth login code and returns the `loginToken` and `userId`. Use these values as the `X-Auth-Token` and `X-User-Id` headers in authenticated requests.\n\nThis endpoint does not require authentication. Each code is single-use, expires after 60 seconds, and is limited to 10 redemption requests per minute per caller.\n\n### Changelog\n| Version | Description |\n| ------- | ----------- |\n| 8.7.0   | Added       |",
        "operationId": "post-api-v1-loginCode.redeem",
        "requestBody": {
          "required": "true",
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "additionalProperties": "false",
                "properties": {
                  "code": {
                    "type": "string",
                    "minLength": "64",
                    "maxLength": "64",
                    "description": "The one-time login code issued by the server-side OAuth flow.",
                    "example": "4f1d2c3b4a5968778695a4b3c2d1e0f1123456789abcdef00fedcba987654321"
                  }
                },
                "required": [
                  "code"
                ]
              },
              "examples": {
                "Redeem login code": {
                  "value": {
                    "code": "4f1d2c3b4a5968778695a4b3c2d1e0f1123456789abcdef00fedcba987654321"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "loginToken": {
                      "type": "string"
                    },
                    "userId": {
                      "type": "string"
                    },
                    "success": {
                      "type": "boolean"
                    }
                  },
                  "required": [
                    "loginToken",
                    "userId",
                    "success"
                  ]
                },
                "examples": {
                  "Redemption successful": {
                    "value": {
                      "loginToken": "9HqLlyZOugoStsXCUfD_0YdwnNnunAJF8V47U3QHXSq",
                      "userId": "aobEdbYhXfu5hkeqG",
                      "success": "true"
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "success": {
                      "type": "boolean"
                    },
                    "error": {
                      "type": "string"
                    },
                    "errorType": {
                      "type": "string"
                    }
                  }
                },
                "examples": {
                  "Invalid request": {
                    "value": {
                      "success": "false",
                      "error": "must NOT have fewer than 64 characters [invalid-params]",
                      "errorType": "invalid-params"
                    }
                  },
                  "Invalid or expired code": {
                    "value": {
                      "success": "false",
                      "error": "error-invalid-code"
                    }
                  }
                }
              }
            }
          },
          "401": {
            "$ref": "#/components/responses/authorizationError"
          }
        }
      }
    }
  },
  "components": {
    "responses": {
      "authorizationError": {
        "description": "Unauthorized",
        "content": {
          "application/json": {
            "schema": {
              "type": "object",
              "properties": {
                "status": {
                  "type": "string"
                },
                "message": {
                  "type": "string"
                }
              },
              "x-examples": {
                "Authorization Error": {
                  "status": "error",
                  "message": "You must be logged in to do this."
                }
              }
            },
            "examples": {
              "Authorization Error": {
                "value": {
                  "status": "error",
                  "message": "You must be logged in to do this."
                }
              }
            }
          }
        }
      }
    }
  }
}
````