A valid request URL is required to generate request examples{
"contact": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"email": "<string>",
"avatar_url": "<string>",
"locale": "en",
"identified": true,
"email_verified": true,
"attribution": {
"utm_source": "<string>",
"utm_medium": "<string>",
"utm_campaign": "<string>",
"utm_term": "<string>",
"utm_content": "<string>",
"referrer": "<string>",
"landing_page": "<string>"
},
"first_seen_at": "2023-11-07T05:31:56Z",
"last_seen_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z"
},
"token": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"verified": true
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Sign in with an email code
Spends the code and signs the contact in. The code arrived in the inbox, so it proves the address exactly like a magic link does: the contact is marked identified, the address is marked verified, and the session it mints is verified.
Every failure answers the same invalid_code — a wrong code, an expired or already-spent one, a challenge issued for another environment, and a challenge that never had a code behind it because the address has no account. Anything else would move the enumeration oracle here.
Each code carries an attempt budget of 5. A guess costs one whether or not it was right, and the code is dead when the budget runs out: six digits is a million, which a rate limit alone does not close.
Rate limited to 20 requests per 5 minutes per IP.
A valid request URL is required to generate request examples{
"contact": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"email": "<string>",
"avatar_url": "<string>",
"locale": "en",
"identified": true,
"email_verified": true,
"attribution": {
"utm_source": "<string>",
"utm_medium": "<string>",
"utm_campaign": "<string>",
"utm_term": "<string>",
"utm_content": "<string>",
"referrer": "<string>",
"landing_page": "<string>"
},
"first_seen_at": "2023-11-07T05:31:56Z",
"last_seen_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z"
},
"token": "<string>",
"expires_at": "2023-11-07T05:31:56Z",
"verified": true
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}