---
title: "Create origin handoff"
method: POST
path: "/auth/origin-handoff"
tags: ["Auth"]
---

# Create origin handoff

`POST /auth/origin-handoff`

Store encrypted client state for up to two minutes so another first-party web origin can redeem it once. The receiving origin must present the nonce whose SHA-256 digest is sent here.

## Request body

- OriginHandoffCreateRequest
  - `nonce_hash` string, required — Lowercase hex SHA-256 digest of the nonce the receiving origin holds
  - `payload` string, required — Encrypted client state encoded as base64url

## Response `200`

Success

- OriginHandoffCreateResponse
  - `handoff_id` string, required — Single-use identifier the receiving origin redeems

## Other responses

- `400` — Bad Request - The request was malformed or contained invalid data
- `401` — Unauthorized - Authentication is required or the token is invalid
- `403` — Forbidden - You do not have permission to perform this action
- `429` — Too Many Requests - You are being rate limited
- `500` — Internal Server Error - An unexpected error occurred

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) · [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/3d3fd6ec1785?raw)