---
title: "Mint a one-time cross-host sign-in code"
method: POST
path: "/api/auth/handoff"
tags: ["Authentication"]
---

# Mint a one-time cross-host sign-in code

`POST /api/auth/handoff`

## Request

- Base URL: `https://domani.run`
- URL: `https://domani.run/api/auth/handoff`
- Auth: HTTP bearer

Browser-only: lets a signed-in person on domani.run or mailzero.run resume their session on the other host without a second magic link. Returns a URL whose fragment carries a 60-second, single-use, host-bound code; the code is never logged or sent in a query string. Not useful outside a browser session, so it is not exposed as an agent tool.

## Request body

- object
  - `target` 'mail' | 'domani', required
  - `path` string, required

## Response `200`

One-time handoff URL

- object
  - `url` string

## Other responses

- `400`: Invalid request parameters
- `401`: Missing or invalid API key
- `429`: Rate limit exceeded - wait and retry

---

[API](https://skmtc.dev/domani/apis/domani-run-api.md) · [All operations](https://skmtc.dev/domani/apis/domani-run-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domani/apis/domani-run-api/revisions/7679f8159533?raw)