# Send the code a provider's frame asked for

> Send the code a provider's frame asked for: CustomDomain™ API reference in the cloud browser group. Covers parameters, request body, responses and error codes.

Source: https://docs.customdomain.ai/docs/api-reference/cloud-browser/codeBrowserSession

## `POST https://api.customdomain.ai/v1/browser-sessions/{sid}:code`

While the view says `handback: {reason: code, relay: true}`, the agent waits for a one time code the provider asks for in a frame of its own after the sign in (Squarespace's "Verify to continue"). The popup's own code screen sends it here; the agent types it into the provider's frame and presses its verify button. The code is kept nowhere: it goes to the waiting run and is forgotten, and it is in no log, trace or model prompt.

### Authentication

`browserSession`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `sid` | path | string | yes | The cloud browser session id, `bs_` and 32 hex characters. |

### Request body (JSON)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | string | yes | The code, 4 to 12 letters and digits (spaces and dashes are dropped). |

### Responses

| Status | Description |
| --- | --- |
| `204` | The agent has the code and types it now. |
| `400` | The body is not a small JSON object with a code of that shape. The code is never echoed. |
| `401` | `browser_expired`: the token is wrong, expired, or for another session. |
| `404` | Error envelope: {code, title, details}. |
| `409` | `browser_wrong_state`: no code is asked for now, or one is already on its way. |
| `410` | `browser_expired`: the session ran out of time. |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.