Trade a sign-in handoff for a session
The web app posts the handoff code from /auth/complete. Single use, 60 seconds; the answer has the same shape as /auth/verify. Limited to 30 attempts per address per 10 minutes.
POST
/auth/sso/exchange Body
handoffstring Required