Finish signing in with X
Redirect target for X. Settles the Pear account that has this X account connected, and never creates one. Redirects to the frontend with `x_login`, `x_handoff`, and on success an `x_ticket` fragment to redeem below. Always redirects, never renders an error.
curl -X GET "https://example.com/auth/login/x/callback"Empty
Start signing in with X POST
Returns the X authorization URL to send the browser to. The flow finishes at the callback below, which returns the browser to `returnTo`.
Redeem a finished X sign-in POST
Exchanges the single-use ticket from the callback for a session, proving this is the browser that started the sign-in by presenting the verifier behind its challenge. Returns the token pair in the body and sets the session cookies, so bearer and cookie clients are both served.