Add POST /auth/exchange API