Skip to main content
POST
Mint a short-lived token for a wallet app round trip

Authorizations

Authorization
string
header
required

Server-side only. Never ships to a browser.

Headers

Idempotency-Key
string
required

Required on every mutating request. Absent is a 400.

Required string length: 8 - 200

Path Parameters

id
string
required

Body

application/json
code_challenge
string
required

Base64url SHA-256 of a verifier your browser keeps. Required, not optional: a handoff token travels through a URL and must be assumed to leak, and an optional binding is one an attacker can strip.

Minimum string length: 43

Response

The handoff token.

handoff_token
string
required
expires_at
string<date-time>
required