---
title: "Redeem origin handoff"
method: POST
path: "/auth/origin-handoff/redeem"
tags: ["Auth"]
---

# Redeem origin handoff

`POST /auth/origin-handoff/redeem`

Return the encrypted client state stored by create origin handoff and delete it in the same step. A wrong nonce also consumes the handoff. On the official instance the request must come from a first-party web origin.

## Request body

- OriginHandoffRedeemRequest
  - `handoff_id` string, required — Identifier returned when the handoff was created
  - `nonce` string, required — Nonce whose SHA-256 digest was sent when the handoff was created

## Response `200`

Success

- OriginHandoffRedeemResponse
  - `payload` string, required — Encrypted client state encoded as base64url

## Other responses

- `400` — Bad Request - The request was malformed or contained invalid data
- `429` — Too Many Requests - You are being rate limited
- `500` — Internal Server Error - An unexpected error occurred

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) · [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/55834b33d5d5?raw)