Issue a one-time exchange code for the current user JWT
OAuth
Issue a one-time exchange code for the current user JWT
Replace an authenticated user JWT with a short-lived one-time code.
Dashboard and customer backends call this before constructing a Connect URL. The already-verified JWT is read from the Authorization header and stored server-side; only the opaque code is allowed into the browser URL. API keys and admin tokens are rejected because Connect requires a concrete app user subject.
POST
Issue a one-time exchange code for the current user JWT