---
title: "Redeem a one-time cross-host sign-in code"
method: POST
path: "/api/auth/handoff/redeem"
tags: ["Authentication"]
---

# Redeem a one-time cross-host sign-in code

`POST /api/auth/handoff/redeem`

## Request

- Base URL: `https://domani.run`
- URL: `https://domani.run/api/auth/handoff/redeem`
- Auth: none required

Browser-only: called by the /auth/handoff page on the target host to exchange the code from the URL fragment for a session, exactly like GET /api/auth/verify does for a magic link. The code must match the Host this request arrived on. Not an agent tool.

## Request body

- object
  - `code` string, required

## Response `200`

Signed in - sets the short-lived session cookie GET /api/auth/session reads

- object
  - `ok` boolean
  - `next` string

## Other responses

- `401`: The code is missing, expired, used, or was issued for a different host
- `429`: Rate limit exceeded - wait and retry

---

[API](https://skmtc.dev/domani/apis/domani-run-api.md) · [All operations](https://skmtc.dev/domani/apis/domani-run-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domani/apis/domani-run-api/revisions/7679f8159533?raw)