Sign in
Auth

Create origin handoff

Store encrypted client state for up to two minutes so another first-party web origin can redeem it once. The receiving origin must present the nonce whose SHA-256 digest is sent here.

post/auth/origin-handoff

Request body

nonce_hashstring required

Lowercase hex SHA-256 digest of the nonce the receiving origin holds

payloadstring required

Encrypted client state encoded as base64url

Response

Success

handoff_idstring required

Single-use identifier the receiving origin redeems

Changes