Passwordless email sign-in

Request and consume a one-time email sign-in code. Request responses do not reveal whether an account exists. Verify availability before integrating.

API conventions · All endpoints · Schemas

`/e/v1/auth/magic-link/request/`

Request an application-user email login code.

Availability note: standalone access with the credential described below has a known authentication limitation. Check integration availability before relying on this operation. If it returns an unexpected 401, contact support with the endpoint and sanitized response.

POST

Required email string; optional oauth_client tenant context and redirect_uri. Valid-shaped requests return a generic message to avoid revealing account existence. See the availability note before integrating.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
body	`oauth_client`	`not supplied`
body	`redirect_uri`	`not supplied`
body	`email`	`not supplied`

Example request body:

{
  "email": "[email protected]",
  "oauth_client": "PUBLIC_CLIENT_ID"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "message": "If that email exists, a login link has been sent."
}

400 — json

{
  "error": "email is required"
}

`/e/v1/auth/magic-link/consume/`

Exchange an emailed code for application tokens or an MFA ticket.

POST

Required JSON email and code; keep original oauth_client context. Code is single-use and expires. MFA-enabled users must finish the challenge before tokens are issued.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
body	`oauth_client`	`not supplied`
body	`code`	`not supplied`
body	`email`	`not supplied`

Related schemas: User.

Example request body:

{
  "email": "[email protected]",
  "code": "MAGIC_LINK_CODE",
  "oauth_client": "PUBLIC_CLIENT_ID"
}

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "user": {
    "id": "11111111-1111-4111-8111-111111111111",
    "email": "[email protected]",
    "first_name": "Example",
    "last_name": "Example",
    "company": "EXAMPLE_COMPANY",
    "website": "https://app.example.test/callback",
    "country": "EXAMPLE_COUNTRY",
    "job_title": "EXAMPLE_JOB_TITLE",
    "phone_number": "EXAMPLE_PHONE_NUMBER",
    "email_verified": true,
    "created_at": "2026-10-26T12:00:00Z",
    "updated_at": "2026-10-26T12:00:00Z",
    "last_login": "2026-10-26T12:00:00Z",
    "created_via_api_key": "EXAMPLE_CREATED_VIA_API_KEY",
    "developer_id": "EXAMPLE_DEVELOPER_ID",
    "workspace": "11111111-1111-4111-8111-111111111111",
    "oauth_client": "11111111-1111-4111-8111-111111111111"
  },
  "token": "EXAMPLE_TOKEN",
  "refresh_token": "EXAMPLE_REFRESH_TOKEN",
  "message": "Login successful"
}

200 — json

{
  "mfa_required": true,
  "mfa_ticket": "EXAMPLE_MFA_TICKET",
  "mfa_methods": []
}

400 — json

{
  "error": "email and code are required"
}

400 — json

{
  "error": "Invalid or expired code"
}

/e/v1/auth/magic-link/request/​

POST​

/e/v1/auth/magic-link/consume/​

POST​

`/e/v1/auth/magic-link/request/`

POST

`/e/v1/auth/magic-link/consume/`

POST