Exchange the HttpOnly login-handoff cookie for the JWT (one-time)
Completes the login handoff. The OAuth callback (and dev login) set a short-lived HttpOnly cookie scoped to this path; this endpoint returns the JWT once and expires the cookie in the same response (delete-on-read), so a second call gets 401. POST keeps the exchange non-cacheable, and SameSite=Lax blocks cross-site POSTs from carrying the cookie. Unauthenticated by design — the caller has no bearer token yet.
post/auth/handoff
Request
- Base URL: /api/v1 (relative, and the document was published on a file host, not at the API’s origin)
- URL: /api/v1/auth/handoff
- Auth: none required
Response
The JWT, exactly once; the handoff cookie is expired in the same response.
Changes
No recorded changes to this operation across all 14 revisions of this API.