Finish linking an X account
Redirect target for X. Always redirects to the frontend with a status, never renders an error. Takes no credential: the `state` parameter is what identifies the account, and it is unguessable, single-use and minted only by an authenticated start.
curl -X GET "https://example.com/auth/link/x/callback"Start linking an X account POST
Returns the X authorization URL to send the browser to. The flow finishes at the callback below, which returns the browser to `returnTo`.
Show or hide the X account on the leaderboard PATCH
Withholding stops the handle, name and avatar being published to other users while keeping the account linked, so signing in through X still works. Takes the wanted state, not a flip, so a retry lands on the same result. Does not require a linked X account: the setting belongs to the user and outlives the link, so it can be set beforehand and survives a disconnect and reconnect.