What is connect handoff?
A connect handoff mints a one-time, host-scoped link that expires in about half an hour. The end user opens it and completes the sign-in — password, second factor, CAPTCHA — in a hosted browser, and the authenticated session is captured and encrypted against that host and account label. Later runs restore it.
Why it matters
It answers two different problems with one flow. The password may belong to your customer and should not pass through your system; or the site may hard-challenge automated sign-in from datacenter IPs and simply cannot be signed into by an agent at all. In both cases a real person signing in once is the only correct answer.