Redeem a federated-login handoff code
POST/api/v1/auth/handoff/exchange
A federated login (Google, GitHub, GitLab, Microsoft, Discord, Slack,
OIDC, SAML) ends with a redirect to /d/auth/complete?code=.... The
code is single use and expires after 60 seconds; this endpoint trades
it for the session the provider callback minted, in the login
response shape. An unknown, reused, expired or forged code always
gets the same 401 body.
A user with TOTP enabled gets no session from the callback: the
exchange then answers requires2Fa and tempToken (plus returnTo
and membershipPending), with no token and no user, and sets no
cookie. The sign-in finishes through /api/v1/auth/2fa/verify.
Request
Responses
- 200
- 401
- 422
Session handed over
Authentication required
Validation error