Passwordless email sign-in

Request and consume a one-time email sign-in code. Request responses do not reveal whether an account exists. Verify availability before integrating.

API conventions · All endpoints · Schemas

/e/v1/auth/magic-link/request/

Request an application-user email login code.

Availability note: standalone access with the credential described below has a known authentication limitation. Check integration availability before relying on this operation. If it returns an unexpected 401, contact support with the endpoint and sanitized response.

POST

Required email string; optional oauth_client tenant context and redirect_uri. Valid-shaped requests return a generic message to avoid revealing account existence. See the availability note before integrating.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
body	oauth_client	not supplied
body	redirect_uri	not supplied
body	email	not supplied

Example request body:

{
  "email": "[email protected]",
  "oauth_client": "PUBLIC_CLIENT_ID"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "message": "If that email exists, a login link has been sent."
}

400 — json

{
  "error": "email is required"
}

/e/v1/auth/magic-link/consume/

Exchange an emailed code for application tokens or an MFA ticket.

Availability note: standalone access with the credential described below has a known authentication limitation. Check integration availability before relying on this operation. If it returns an unexpected 401, contact support with the endpoint and sanitized response.

POST

Required JSON email and code; keep original oauth_client context. Code is single-use and expires. MFA-enabled users must finish the challenge before tokens are issued.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
body	oauth_client	not supplied
body	code	not supplied
body	email	not supplied

Related schemas: User.

Example request body:

{
  "email": "[email protected]",
  "code": "MAGIC_LINK_CODE",
  "oauth_client": "PUBLIC_CLIENT_ID"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "user": {
    "id": "11111111-1111-4111-8111-111111111111",
    "email": "[email protected]",
    "first_name": "Example",
    "last_name": "Example",
    "company": "EXAMPLE_COMPANY",
    "website": "https://app.example.test/callback",
    "country": "EXAMPLE_COUNTRY",
    "job_title": "EXAMPLE_JOB_TITLE",
    "phone_number": "EXAMPLE_PHONE_NUMBER",
    "email_verified": true,
    "created_at": "2026-10-26T12:00:00Z",
    "updated_at": "2026-10-26T12:00:00Z",
    "last_login": "2026-10-26T12:00:00Z",
    "created_via_api_key": "EXAMPLE_CREATED_VIA_API_KEY",
    "developer_id": "EXAMPLE_DEVELOPER_ID",
    "workspace": "11111111-1111-4111-8111-111111111111",
    "oauth_client": "11111111-1111-4111-8111-111111111111"
  },
  "token": "EXAMPLE_TOKEN",
  "refresh_token": "EXAMPLE_REFRESH_TOKEN",
  "message": "Login successful"
}

200 — json

{
  "mfa_required": true,
  "mfa_ticket": "EXAMPLE_MFA_TICKET",
  "mfa_methods": []
}

400 — json

{
  "error": "email and code are required"
}

400 — json

{
  "error": "Invalid or expired code"
}