Exchange a cookie session for raw Supabase tokens
Auth
Exchange a cookie session for raw Supabase tokens
One-shot endpoint called by the SPA during the CLI login flow (browser → localhost handoff). Requires a valid mnemom_session. Returns access + refresh tokens in the JSON body. Does not modify cookies.
POST
Exchange a cookie session for raw Supabase tokens
Authorizations
HttpOnly, Secure, SameSite=Lax cookie issued by /v1/auth/sign-in (or the SSO / email-callback flows). The value is an AES-256-GCM-encrypted blob of {access_token, refresh_token, issued_at, auth_method}. Browser clients include this automatically with credentials: "include".