---
title: "Initiate handoff"
method: POST
path: "/auth/handoff/initiate"
tags: ["Auth"]
---

# Initiate handoff

`POST /auth/handoff/initiate`

Start a handoff session to transfer authentication between devices. Returns a handoff code for device linking.

## Response `200`

Success

- HandoffInitiateResponse
  - `code` string, required — Handoff code to share with the receiving device
  - `expires_at` string, date-time, required — ISO 8601 timestamp when the handoff code expires
  - `poll_secret` string — Secret the initiating device must present to retrieve the token

## Other responses

- `400` — Bad Request - The request was malformed or contained invalid data
- `429` — Too Many Requests - You are being rate limited
- `500` — Internal Server Error - An unexpected error occurred

## Changes

> 21 revisions in range; 2 not diffed.

- **2026-09-18** `dd0ad4ea1c88` — 1 info
  - the `expires_at` response's property pattern was changed from `^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$` to `^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$` for the status `200`
- **2026-09-06** `a52a2cf49d9b` — 16 warning, 100 info
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `400`
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `500`
  - added the new `PHONE_COUNTRY_NOT_SUPPORTED` enum value to the `code` response property for the response status `400`
  - added the new `PHONE_COUNTRY_NOT_SUPPORTED` enum value to the `code` response property for the response status `500`
  - …112 more
  - …this revision’s changelog is incomplete
- …earlier changes not shown

[Full history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/auth/handoff/initiate/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) · [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/3d3fd6ec1785?raw)