---
title: "Mint a one-time code for crossing to the product"
method: POST
path: "/api/auth/handoff"
tags: ["Sessions"]
---

# Mint a one-time code for crossing to the product

`POST /api/auth/handoff`

The session held on result.dev cannot be shared with app.result.dev by cookie — the refresh token is host-only and must stay that way — so crossing is a one-time code instead. It is single-use, expires in minutes, is stored only as a hash, and is spent by the product's own /auth/enter page. Never cached.

## Request body

- object
  - `next` string — Where to land inside the product. Must be a same-origin path; anything else — an absolute URL, a protocol-relative one, a backslash escape — is replaced with `/`.

## Response `200`

The one-time code.

- object
  - `data` object, required
    - `code` string, required — Pass as `?code=` to the product's /auth/enter page. Single use, minutes long.

## Other responses

- `401` — No session token, or a token that is expired or invalid.
- `405` — This path exists but not for this method.
- `500` — Something failed on our side. The response body says so and nothing more; the detail is in our logs.

---

[API](https://skmtc.dev/result/apis/result-api.md) · [All operations](https://skmtc.dev/result/apis/result-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/result/result-api/revisions/103d45168871/schema)