Sign in
Auth

Redeem origin handoff

Return the encrypted client state stored by create origin handoff and delete it in the same step. A wrong nonce also consumes the handoff. On the official instance the request must come from a first-party web origin.

post/auth/origin-handoff/redeem

Request body

handoff_idstring required

Identifier returned when the handoff was created

noncestring required

Nonce whose SHA-256 digest was sent when the handoff was created

Response

Success

payloadstring required

Encrypted client state encoded as base64url

Changes