---
title: "The page redeems the session hand-off's one-time code for its own session"
method: POST
path: "/v1/auth/page/session-handoff"
tags: ["auth"]
---

# The page redeems the session hand-off's one-time code for its own session

`POST /v1/auth/page/session-handoff`

## Request

- Base URL: `https://api.sixminute.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sixminute.ai/v1/auth/page/session-handoff`
- Auth: none declared

The code the daemon was answered at POST /v1/devices/session-handoff, handed over by the shell. Requires X-Six-Minute-Page: 1 from an allowed Origin, and is limited per caller. Works once per device, within its minute, while the device still holds the credential the exchange issued and is not revoked; anything else is 401. The refresh token is kept in the http-only cookie and is not in the answer, except for a page in storage mode (`storage: true`) on an environment with no custom authentication domain; asked elsewhere that is 403. Deleted at phase 7.

## Request body

- object
  - `code` string, required
  - `storage` boolean

## Response `200`

The session; the refresh token is in the http-only cookie, or here for a page in storage mode.

- object
  - `access_token` string, required
  - `organization_id` string, nullable
  - `user` object, required
    - `id` string, required
    - `email` string, required
    - `first_name` string, nullable
    - `last_name` string, nullable
  - `refresh_token` string

## Other responses

- `400`: The body, query or path did not validate; `errors` lists the fields.
- `401`: No bearer token, or one that does not verify or has expired.
- `403`: The token verified but may not do this: no organisation, not provisioned, wrong role, or a device problem.
- `429`: Too many requests; `Retry-After` says how long to wait.
- `502`: An upstream this service depends on failed or answered nonsense.

---

[API](https://skmtc.dev/sixminute/apis/sixminute-api.md) - [All operations](https://skmtc.dev/sixminute/apis/sixminute-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sixminute/apis/sixminute-api/revisions/605577eadc10?raw)