Backend-Initiated Handoff

If your frontend does not have access to the user's credentials for example, when credentials are stored or brokered only by your backend the handoff POST can be initiated from your backend instead of the browser.

How it works

1. Your backend submits the POST to <https://<user-portal-domain>>/userportal/auth-handoff with the same payload described in Request Payload.

2. The Gateway returns the resulting redirect (3xx, typically 302) to your backend.

3. Your backend returns that redirect to the browser as a short hop.

4. The browser follows the Gateway-issued redirect to the User Portal destination.

The end state is identical to the frontend-initiated flow: the browser ends up at the User Portal destination returned by the POST response.

Note: The backend-initiated flow is intended only for the case where the frontend does not have access to the credentials. If the browser has the credentials, POST directly from the frontend it is simpler and avoids relaying the redirect through your backend.

Your responsibilities in this flow

• Submit the POST from the backend where the credentials are located.

• Relay the Gateway's redirect response to the browser unchanged.

• Do not inspect or modify the redirect target or any tokens it carries — token creation, validation, and session handling are managed by the User Portal Gateway.