Email a 6-digit sign-in code
Returns an opaque `requestId` — the half the client keeps — and emails the code. An address with no account still gets a requestId (a decoy that resolves to no row), so the response shape never differs. The code is stored only as a salted digest and is attempt-capped.
Path Parameters
Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.
uuidRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/otp/request" \ -H "Content-Type: application/json" \ -d '{ "email": "user@example.com" }'{ "message": "string", "requestId": "string"}Sign out (end the session)
Ends the session the presented token belongs to: its refresh token and all of its access tokens stop working immediately. Send the refresh token as `refreshToken` in the body (preferred — it works after the access token has expired), or the access token as `Authorization: Bearer <token>`. When a body refresh token is present, the header is ignored. Idempotent: signing out of a session that has already ended returns 200.
Email a one-click sign-in link
Sends a single-use, short-lived sign-in link. ALWAYS returns the same generic 200 whether or not the address has an account — the response is the enumeration channel, so it carries no signal. Sign-up via magic link is off unless AUTH_MAGIC_LINK_ALLOW_SIGNUP is set.