---
title: "Finish a signup with the code from the inbox"
method: POST
path: "/v1/auth/verify-email"
tags: ["Auth"]
---

# Finish a signup with the code from the inbox

`POST /v1/auth/verify-email`

## Request

- Base URL: `https://api.briefgate.dev`
- URL: `https://api.briefgate.dev/v1/auth/verify-email`
- Auth: none required

Signup creates the account but issues neither a session nor an API key until the address is confirmed, so registering under someone else's address gains nothing. This exchanges the six-digit code for a session. Unknown addresses, wrong codes and expired ones are answered identically, so this cannot be used to discover which addresses have accounts. Five wrong attempts burn the code.

## Request body

- object
  - `email` string, email, required
  - `code` string, required: Six digits.

## Response `200`

Confirmed; the session cookie is set

- object
  - `verified` boolean
  - `user` object
  - `account` object
  - `api_key_id` string, nullable

## Other responses

- `401`: Invalid or expired
- `403`: Too many attempts from this address
- `422`: Validation error — the body shape is correct but values are invalid

---

[API](https://skmtc.dev/briefgate/apis/briefgate-api.md) · [All operations](https://skmtc.dev/briefgate/apis/briefgate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/briefgate/apis/briefgate-api/revisions/b21afed4748b?raw)