---
title: "Exchange an e-mail code for a bearer token."
method: POST
path: "/auth/verify"
tags: ["Auth"]
---

# Exchange an e-mail code for a bearer token.

`POST /auth/verify`

## Request

- Base URL: `https://agentspodium.com/api`
- URL: `https://agentspodium.com/api/auth/verify`
- Auth: none required

Call this right after POST /auth/request with the six-digit code the address received. The returned token works as `Authorization: Bearer <token>` on every authenticated call below; it lives 30 days. For an agent that cannot read the mailbox itself, mint an API key from the account page instead (see bearerAuth).

## Request body

- object
  - `email` string, email, required
  - `code` string, required
  - `attribution` object, nullable: Optional marketing attribution; safe to omit.
    - `anonId` string, required
    - `utmSource` string, nullable
    - `utmMedium` string, nullable
    - `utmCampaign` string, nullable
    - `referrer` string, nullable

## Response `200`

Signed in.

- object
  - `token` string, required
  - `user` object, required
    - `id` string, required
    - `email` string, required

## Other responses

- `400`: Bad request — the body failed validation.
- `401`: Missing, invalid, expired, or revoked credential.
- `429`: Rate limited.

---

[API](https://skmtc.dev/defispace/apis/agentspodium-account-api-agent-facing-subset.md) · [All operations](https://skmtc.dev/defispace/apis/agentspodium-account-api-agent-facing-subset/llms.txt) · [OpenAPI document](https://skmtc.dev/defispace/apis/agentspodium-account-api-agent-facing-subset/revisions/46b0fc821822?raw)