Authentication

Redeem a mobile OAuth callback code for a session.

Mobile-only: the app’s custom-scheme OAuth callback carries a single-use code (not the session directly); this exchanges it for the session cookie, landing in the app’s own cookie jar. Public — the code is the credential, and a missing/expired/reused one is a 401.

curl -X POST "https://freehire.me/api/v1/auth/oauth/exchange" \
  -H 'Content-Type: application/json' -c cookies.txt \
  -d '{"code":"..."}'

{ "data": { "id": 1, "email": "me@example.com", "role": "user" } }