Error

A valid request URL is required to generate request examples

{
  "contact": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "name": "<string>",
    "email": "<string>",
    "avatar_url": "<string>",
    "identified": true,
    "email_verified": true,
    "attribution": {
      "utm_source": "<string>",
      "utm_medium": "<string>",
      "utm_campaign": "<string>",
      "utm_term": "<string>",
      "utm_content": "<string>",
      "referrer": "<string>",
      "landing_page": "<string>"
    },
    "first_seen_at": "2023-11-07T05:31:56Z",
    "last_seen_at": "2023-11-07T05:31:56Z",
    "created_at": "2023-11-07T05:31:56Z"
  },
  "token": "<string>",
  "expires_at": "2023-11-07T05:31:56Z",
  "verified": true
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Customer plane

Sign in with an email code

Spends the code and signs the contact in. The code arrived in the inbox, so it proves the address exactly like a magic link does: the contact is marked identified, the address is marked verified, and the session it mints is verified.

Every failure answers the same invalid_code — a wrong code, an expired or already-spent one, a challenge issued for another environment, and a challenge that never had a code behind it because the address has no account. Anything else would move the enumeration oracle here.

Each code carries an attempt budget of 5. A guess costs one whether or not it was right, and the code is dead when the budget runs out: six digits is a million, which a rate limit alone does not close.

With two-factor on, the answer is a TwoFactorChallenge instead of a session — the code is spent either way.

Rate limited to 20 requests per 5 minutes per IP.

POST

contact-auth

email-code

verify

Error

A valid request URL is required to generate request examples

{
  "contact": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "name": "<string>",
    "email": "<string>",
    "avatar_url": "<string>",
    "identified": true,
    "email_verified": true,
    "attribution": {
      "utm_source": "<string>",
      "utm_medium": "<string>",
      "utm_campaign": "<string>",
      "utm_term": "<string>",
      "utm_content": "<string>",
      "referrer": "<string>",
      "landing_page": "<string>"
    },
    "first_seen_at": "2023-11-07T05:31:56Z",
    "last_seen_at": "2023-11-07T05:31:56Z",
    "created_at": "2023-11-07T05:31:56Z"
  },
  "token": "<string>",
  "expires_at": "2023-11-07T05:31:56Z",
  "verified": true
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "your role does not allow this action"
  }
}

Body

application/json

publishable_key

string

required

challenge_token

string

required

Example:

"uk_ec_…"

code

string

required

The six digits from the email.

Example:

"418902"

Response

Signed in, or stopped at the second factor.

Option 1
Option 2

contact

object

One of the developer's own users — anonymous or identified.

Show child attributes

token

string

Contact session token, uk_ct_….

expires_at

string<date-time>

verified

boolean

Request an email sign-in code Read the current contact

⌘I

Overview

Endpoints

Sign in with an email code

Body

Response