Sessions

Mint a one-time code for crossing to the product

The session held on result.dev cannot be shared with app.result.dev by cookie — the refresh token is host-only and must stay that way — so crossing is a one-time code instead. It is single-use, expires in minutes, is stored only as a hash, and is spent by the product's own /auth/enter page. Never cached.

post/api/auth/handoff

Request body

nextstring

Where to land inside the product. Must be a same-origin path; anything else — an absolute URL, a protocol-relative one, a backslash escape — is replaced with /.

Example request

{
  "next": "/finance/payments"
}

Response

The one-time code.

Changes

No recorded changes to this endpoint across all 1 revision of this API.