Trade the one-time code for a session token. Called by the dashboard on landing. On success the browser is redirected to the dashboard's /rs-sso-login/ page with the new bearer token in the token query parameter; there is no JSON body. The code works once, and expires 2 minutes after it was issued by default.

Prerequisites: the code from JumpCloud: callback.

Authentication: Public (no token). The one-time code is the credential. The user must still have JumpCloud sign-in turned on when the code is redeemed; otherwise 400.

Rate limit: 10 requests per minute, counted per client IP address.