Confirm a link from the Keelson window

POST/v1/embed/links/confirm

The signed-in user confirms the embedded approval that opened this window, named by its ref. The answer is a single-use grant the window hands only to that frame, its opener on Keelson's origin; the frame claims it with POST /v1/embed/links/claim. The frame may create a passkey only for a user who has none.

Headers

Content-Typeapplication/jsonRequired
Idempotency-KeystringRequired: 1 to 255 characters. A retry with the same key returns the first answer.

Request body

application/json

noncestringRequired
refstringRequired

Responses

200The grant for the frame
401Not signed in
404The link is unknown, spent, expired or for another request

200 response

originstringRequired
grantstringRequired
expires_inintegerRequired

curl -X POST https://api.keelson.finance/v1/embed/links/confirm \
  -H 'content-type: application/json' \
  -H "idempotency-key: $(uuidgen)" \
  --data '{"nonce":"string","ref":"string"}'

const res = await fetch("https://api.keelson.finance/v1/embed/links/confirm", {
  method: "POST",
  headers: {
    "content-type": "application/json",
    "idempotency-key": crypto.randomUUID(),
  },
  body: JSON.stringify({
    "nonce": "string",
    "ref": "string"
  }),
});
const data = await res.json();

Response · shape from the schema

{
  "origin": "string",
  "grant": "string",
  "expires_in": 0
}