Sign in with a magic link
Spends the token from the emailed URL and issues a session. Single use: a second attempt with the same token fails like any other invalid link.
Path Parameters
Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.
uuidRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/magic-link/verify" \ -H "Content-Type: application/json" \ -d '{ "token": "stringstringstringstringstringst" }'{ "uid": "string", "email": "user@example.com", "fname": "string", "lname": "string", "status": "string", "auth": { "accessToken": "string", "refreshToken": "string", "activeOrgUid": "string" }, "orgUid": "string", "org": { "uid": "string", "name": "string" }}Send a magic link
Sends a single-use, short-lived sign-in link. ALWAYS returns the same generic 200 whether or not the address has an account — the response is the enumeration channel, so it carries no signal. Sign-up via magic link is off unless AUTH_MAGIC_LINK_ALLOW_SIGNUP is set.
Send a sign-in code
Returns an opaque `requestId` — the half the client keeps — and emails the code. An address with no account still gets a requestId (a decoy that resolves to no row), so the response shape never differs. The code is stored only as a salted digest and is attempt-capped.