API ReferenceGeneratedAuth

Sign in with a 6-digit code

Pairs the requestId with the emailed code. A wrong code costs one attempt but does NOT consume the request, so a typo does not force a new code; exhausting the attempt budget revokes it.

POST
/{appUid}/auth/otp/verify

Path Parameters

appUid*string

Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/otp/verify" \  -H "Content-Type: application/json" \  -d '{    "requestId": "stringstringstringstringstringst",    "code": "string"  }'
{  "uid": "string",  "email": "user@example.com",  "fname": "string",  "lname": "string",  "status": "string",  "auth": {    "accessToken": "string",    "refreshToken": "string",    "activeOrgUid": "string"  },  "orgUid": "string",  "org": {    "uid": "string",    "name": "string"  }}

Remove a linked sign-in method

Unlinks one provider identity. Refuses to remove the LAST way in — unlinking the only provider on an account with no password would lock the owner out with no recovery path. Hard-deletes, so the same provider account can be linked again later.

Sign in with a magic-link token

Spends the token from the emailed URL and issues a session. Single use: a second attempt with the same token fails like any other invalid link.