---
title: "Exchange an emailed code for a token pair"
method: POST
path: "/auth/tokens"
tags: ["Auth"]
---

# Exchange an emailed code for a token pair

`POST /auth/tokens`

## Request

- Base URL: `https://bodylab.lol/api/v1`
- URL: `https://bodylab.lol/api/v1/auth/tokens`
- Auth: none required

## Headers

- `X-Client-Platform` string
- `X-Client-Version` string

## Request body

- object
  - `email` string, required
  - `code` string, required
  - `deviceLabel` string: Shown when managing signed-in devices.
  - `platform` string: The kind of client signing in, as the client declares it — never sniffed from a user agent. Known values: ios, android, web. Treat unknown values as "other".

## Response `200`

OK

- object
  - `accessToken` string, required: Short-lived; send as `Authorization: Bearer <token>`.
  - `refreshToken` string, required: Rotates on every refresh; reusing an old one revokes the chain.
  - `expiresIn` integer, required: Seconds until the access token expires.
  - `userId` string, required: Opaque identifier.

## Other responses

- `401`: Error: INVALID_CODE.

---

[API](https://skmtc.dev/bodylab/apis/body-lab-api.md) · [All operations](https://skmtc.dev/bodylab/apis/body-lab-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bodylab/apis/body-lab-api/revisions/544c201eaf88?raw)