Redeem a sign-in code
POST/v1/auth/code/verify
Exchanges an emailed code for a session, creating the account if the address is new. The code is single-use and short-lived. A code is destroyed after too many wrong guesses, since six digits is small enough to guess given unlimited attempts — the client must then request a new one rather than retry.
Request
Responses
- 200
- 400
- 401
- 429
Authenticated; a session is returned.
The request was malformed or failed validation.
The code is wrong, expired, or already used (invalid_token / expired_token).
Too many incorrect attempts (too_many_attempts); the code has been destroyed and a new one must be requested.