Sign in with a code
Pairs the requestId with the emailed code. A wrong code costs one attempt but does NOT consume the request, so a typo does not force a new code; exhausting the attempt budget revokes it.
Path Parameters
Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.
uuidRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/otp/verify" \ -H "Content-Type: application/json" \ -d '{ "requestId": "stringstringstringstringstringst", "code": "string" }'{ "uid": "string", "email": "user@example.com", "fname": "string", "lname": "string", "status": "string", "auth": { "accessToken": "string", "refreshToken": "string", "activeOrgUid": "string" }, "orgUid": "string", "org": { "uid": "string", "name": "string" }}Send a sign-in code
Returns an opaque `requestId` — the half the client keeps — and emails the code. An address with no account still gets a requestId (a decoy that resolves to no row), so the response shape never differs. The code is stored only as a salted digest and is attempt-capped.
Start social sign-in
Mints a single-use `state` and returns the provider's authorize URL for the browser to navigate to. Returns JSON rather than a 302 because the caller is an XHR — a redirect would be followed by the fetch, not the window.