Start signing in with X

Returns the X authorization URL to send the browser to. The flow finishes at the callback below, which returns the browser to `returnTo`.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Start of the X sign-in flow

returnTo?string

Page to send the browser back to once the sign-in finishes, normally the page the user is on. Must be on the calling origin; defaults to that origin. Any fragment is dropped - the flow returns its ticket there.

handoffId*string

Names this sign-in attempt. Echoed back on the return URL so a browser that started more than one knows which secret this outcome belongs to.

Match^[A-Za-z0-9_-]{1,64}$

handoffChallenge*string

Base64url SHA-256 of a random verifier this browser keeps. The finished sign-in is redeemed by presenting that verifier, so only the browser that started the flow can collect it.

Match^[A-Za-z0-9_-]{43}$

Response Body

`application/json`

curl -X POST "https://example.com/auth/login/x/start" \  -H "Content-Type: application/json" \  -d '{    "handoffId": "login-2f8a1c",    "handoffChallenge": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"  }'

{  "authorizeUrl": "string"}

Start signing in with X

Request Body

Response Body

200application/json

`application/json`