When a resource token carries a login_hint claim (secret.agent.coop mints one on the addAddress step-up, scope: email), the proxy should pass it as the login_hint parameter of POST auth_token_endpoint so Hellō pre-selects the verified address instead of prompting. Today exchangeAtPSAndWait sends only resource_token and presented_token.
Without it the flow still works: the person picks the address and the service checks it equals the request (email_mismatch otherwise). Plan reference: agent.coop staged plan, sections D9 and T.
When a resource token carries a
login_hintclaim (secret.agent.coop mints one on theaddAddressstep-up,scope: email), the proxy should pass it as thelogin_hintparameter ofPOST auth_token_endpointso Hellō pre-selects the verified address instead of prompting. TodayexchangeAtPSAndWaitsends onlyresource_tokenandpresented_token.Without it the flow still works: the person picks the address and the service checks it equals the request (
email_mismatchotherwise). Plan reference: agent.coop staged plan, sections D9 and T.