> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myfundedperpetuals.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange a CLI authorization code

> Redeems a one-time authorization code approved in the browser during `fperp login`, together with its PKCE code verifier, for a new expiring CLI session credential. The credential is returned exactly once and authenticates like an API key with trade access to every owned account. Available on the live host only. The `fperp` CLI calls this endpoint itself; it is documented for transparency rather than direct use.



## OpenAPI

````yaml /openapi.yaml post /v1/auth/cli/token
openapi: 3.1.0
info:
  title: MyFundedPerps API (Beta)
  version: 1.0.0
  description: >-
    The developer API is in beta. Breaking changes may be introduced at any
    time. Programmatic access to MyFundedPerps paper-trading challenge accounts.
    API trades use the same real order books and simulated execution engine as
    the web trading interface. Every response carries an `X-Request-Id` header
    for support and log correlation.
  contact:
    url: https://myfundedperpetuals.com/support
servers:
  - url: https://developers.myfundedperpetuals.com
    description: Live
  - url: https://sandbox.myfundedperpetuals.com
    description: Sandbox (test keys and sandbox accounts only)
security:
  - bearerAuth: []
tags:
  - name: General
  - name: Authentication
  - name: Accounts
  - name: Markets
  - name: Positions
  - name: Orders
  - name: Fills
  - name: Strategy Orders
paths:
  /v1/auth/cli/token:
    post:
      tags:
        - Authentication
      summary: Exchange a CLI authorization code
      description: >-
        Redeems a one-time authorization code approved in the browser during
        `fperp login`, together with its PKCE code verifier, for a new expiring
        CLI session credential. The credential is returned exactly once and
        authenticates like an API key with trade access to every owned account.
        Available on the live host only. The `fperp` CLI calls this endpoint
        itself; it is documented for transparency rather than direct use.
      operationId: exchangeCliAuthorizationCode
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - code
                - code_verifier
              properties:
                code:
                  type: string
                  description: One-time authorization code from the approval page.
                code_verifier:
                  type: string
                  description: >-
                    PKCE code verifier that produced the approved S256
                    challenge.
      responses:
        '200':
          description: The new CLI session credential.
          content:
            application/json:
              schema:
                type: object
                required:
                  - data
                properties:
                  data:
                    type: object
                    required:
                      - api_key
                      - token_type
                      - expires_at
                      - name
                    properties:
                      api_key:
                        type: string
                        description: Bearer credential, returned exactly once.
                      token_type:
                        type: string
                        example: Bearer
                      expires_at:
                        type: integer
                        description: Session expiry as a Unix timestamp in milliseconds.
                      name:
                        type: string
                        description: Stored session label derived from the device name.
        '400':
          description: >-
            Invalid request fields, or an invalid, expired, or already used
            code.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          $ref: '#/components/responses/RateLimited'
      security: []
components:
  schemas:
    Error:
      type: object
      required:
        - code
        - message
        - request_id
      properties:
        code:
          type: string
        message:
          type: string
        request_id:
          type: string
          format: uuid
        details:
          type: array
          description: >-
            Present on request-validation failures, with one entry per invalid
            field so a request can be fixed in one pass.
          items:
            $ref: '#/components/schemas/ValidationIssue'
    ValidationIssue:
      type: object
      required:
        - field
        - issue
      properties:
        field:
          type: string
          description: >-
            Wire name of the offending request field, such as `size` or
            `operations[2].price`. The value `body` refers to the whole payload.
        issue:
          type: string
    ErrorEnvelope:
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/Error'
  responses:
    RateLimited:
      description: A per-key, per-IP, or deployment request budget is exhausted.
      headers:
        Retry-After:
          $ref: '#/components/headers/RetryAfter'
        X-Request-Id:
          $ref: '#/components/headers/RequestId'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
  headers:
    RetryAfter:
      description: Seconds to wait before retrying.
      schema:
        type: integer
        minimum: 1
    RequestId:
      description: Stable identifier for support and log correlation.
      schema:
        type: string
        format: uuid
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: MyFundedPerps API key
      description: >-
        API key beginning with `fp_live_` (live keys, served at
        developers.myfundedperpetuals.com) or `fp_test_` (test keys, served at
        sandbox.myfundedperpetuals.com). A key presented on the other host is
        rejected with `401` and a message naming the correct host.

````