Capture an authentication link in API-host HttpOnly custody
Capture an authentication link in API-host HttpOnly custody
GET/api/v1/auth/continuations/{kind}
Opt-in browser navigation for the configured Astro application. Captures
a link token in a purpose-bound encrypted HttpOnly host-only cookie for
ten minutes, then redirects to the fixed application route with an opaque
continuation marker. Email-change capture additionally requires the
current browser session and binds redemption to that account. Existing
raw-token and canonical Web/native flows remain valid. A marker submitted
to its original POST operation requires the matching cookie and kind;
body size is bounded to 65,536 bytes. Successful domain redemption clears
the cookie and the original domain token enforces single use. Invitation
registration retains custody for the separate acceptance operation.
Tokens and continuation cookies must never enter logs or public caches.
Path Parameters
kindRequired
string
Values
passwordemailemail_changeinvitation
Query Parameters
tokenRequired
string·min 1·max 2000
Original link credential; at most 2,000 UTF-8 bytes.
Responses
Location
string <uri>
Fixed kind-specific application route with an opaque continuation marker.
