> ## Documentation Index > Fetch the complete documentation index at: https://api.housera.ro/llms.txt > Use this file to discover all available pages before exploring further. # Exchange the code for the account key > The server-to-server step in "Connect with Housera": the integrator, authenticated with its secret, exchanges the one-time code received at the redirect address (and the `code_verifier` PKCE) for the account key that has been accepted. The code expires in 60 seconds and can only be used once; a code used a second time revokes the key it granted. The complete guide is on the Connect with Housera page. ## OpenAPI ````yaml en/openapi.json POST /oauth/token openapi: 3.1.2 info: title: Housera API version: 1.0.0 description: >- Publish and manage real estate listings on Housera from your CRM or application, with the same rules as the Housera form. servers: - url: https://staging.housera.ro/api/v1 description: 'Sandbox (staging): test data, the same rules as production.' - url: https://housera.ro/api/v1 description: 'Production: real listings from housera.ro.' security: - bearer: [] tags: - name: Your Listings - name: Photos - name: Events - name: Vocabulary - name: Connect with Housera paths: /oauth/token: post: tags: - Connect with Housera summary: Exchange the code for the account key description: >- The server-to-server step in "Connect with Housera": the integrator, authenticated with its secret, exchanges the one-time code received at the redirect address (and the `code_verifier` PKCE) for the account key that has been accepted. The code expires in 60 seconds and can only be used once; a code used a second time revokes the key it granted. The complete guide is on the Connect with Housera page. operationId: v1.oauth.token parameters: - name: locale in: query required: false schema: type: string enum: - ro - en default: en example: en description: >- Response language: messages (`title`, `detail`) and labels, `ro` or `en`. The codes are the same in any language. It takes precedence over `Accept-Language` and the account language. requestBody: required: true content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/OAuthTokenRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/OAuthToken' description: >- The account key, linked to the integrator. Keep it on the server, next to `connection_id`. '400': content: application/json: schema: $ref: '#/components/schemas/OAuthError' description: >- The code is invalid, has expired, has already been used, or does not match the consent request (`invalid_grant`), or `grant_type` is not `authorization_code`. '401': content: application/json: schema: $ref: '#/components/schemas/OAuthError' description: >- `client_id` or `client_secret` incorrect, or the integrator is disabled (`invalid_client`). '429': content: application/problem+json: schema: $ref: '#/components/schemas/Problem' description: Too many requests; please try again after `Retry-After` seconds. security: [] components: schemas: OAuthTokenRequest: type: object title: OAuthTokenRequest properties: grant_type: type: string enum: - authorization_code description: Always `authorization_code`. code: type: string description: The code received at the redirect address, in `?code=`. redirect_uri: type: string description: The exact redirect address from the consent request. code_verifier: type: string minLength: 43 maxLength: 128 description: >- The PKCE verifier you generated before the consent request (43–128 characters). client_id: type: string description: >- The public identifier of the integrator (`hsrc_…`). It can also be sent via HTTP Basic. client_secret: type: string description: >- The integrator's secret (`hsrs_…`), only from your server. It can also be sent via HTTP Basic. required: - grant_type - code - redirect_uri - code_verifier - client_id - client_secret OAuthToken: type: object title: OAuthToken properties: access_token: type: string description: 'The account key, to be sent as `Authorization: Bearer`.' token_type: type: string enum: - Bearer description: Always `Bearer`. expires_in: type: integer description: >- In how many seconds the key expires (365 days). Before expiry, the account goes through consent again. scope: type: string description: The granted rights, separated by space. connection_id: type: integer description: >- The link to this account. It comes in the `connection` field of every event delivered to the integrator's webhook. required: - access_token - token_type - expires_in - scope - connection_id OAuthError: type: object title: OAuthError properties: error: type: string enum: - invalid_client - invalid_grant - unsupported_grant_type description: The error code, according to RFC 6749. error_description: type: string description: The explanation, in the language of the request. required: - error - error_description Problem: type: object title: Problem properties: type: type: string format: uri description: The address of the problem type (RFC 9457). title: type: string description: The summary of the problem, in the language of the request. status: type: integer description: The HTTP code. code: type: string description: >- The stable code of the rejection, which a client branches on (the list in the Errors page). detail: type: string description: The explanation, in the language of the request. required: - type - title - status - code - detail securitySchemes: bearer: type: http scheme: bearer description: 'Authorization: Bearer ' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.