---
title: "Open a page of Pending You on the web, signed in"
method: POST
path: "/v1/web-handoff"
tags: ["web_handoff"]
---

# Open a page of Pending You on the web, signed in

`POST /v1/web-handoff`

## Request

- Base URL: `https://www.pendingyou.com`
- URL: `https://www.pendingyou.com/v1/web-handoff`
- Auth: OAuth 2 (authorization code, authorization URL `https://www.pendingyou.com/oauth/authorize`, token URL `https://www.pendingyou.com/oauth/token`, scopes: `account:manage`)

For Pending You’s own app on the phone, signed in with its key: a link that signs its browser view in to Pending You once, within 60 seconds, and lands on `path` (Settings or one of its sections, an area, a card, or another page of the app). The link stops working once this sign-in ends, and so does the session it starts. Ask for a new one each time: it’s never kept, and never sent again for a retry. Pending You’s own apps only (account:manage).

## Headers

- `Pending-You-Version` '2026-10-05'
- `Pending-You-Client` string
- `DPoP` string

## Request body

- WebHandoffRequest
  - `path` string, required

## Response `200`

Open a page of Pending You on the web, signed in

- WebHandoff
  - `url` string, uri, required
  - `expiresAt` string, date-time, required
  - `path` string, required

## Other responses

- `400`: invalid
- `401`: invalid_token, invalid_dpop_proof or use_dpop_nonce (OAuth, with WWW-Authenticate)
- `403`: app_not_available; forbidden; insufficient_scope (OAuth, with WWW-Authenticate naming the scope)
- `426`: client_outdated
- `429`: rate_limited
- `500`: server_error
- `503`: unavailable

---

[API](https://skmtc.dev/pendingyou/apis/pending-you-person-api.md) · [All operations](https://skmtc.dev/pendingyou/apis/pending-you-person-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pendingyou/apis/pending-you-person-api/revisions/4c0d997495a6?raw)