---
title: "Consume Callback"
method: POST
path: "/v2/auth/callback"
tags: ["auth", "auth"]
---

# Consume Callback

`POST /v2/auth/callback`

## Request

- Base URL: `https://api.etymolt.com`
- URL: `https://api.etymolt.com/v2/auth/callback`
- Auth: none declared

Consume a magic-link token and mint a session.

Single-use at the DB level (see ``_consume_link_atomic``). The first
POST returns the session; any subsequent POST with the same token
is a 401.

CSRF posture: this endpoint accepts an opaque magic-link token
that the attacker would already need to have. The token is the
bearer credential; a cross-site forced POST without the token is
just an empty request that 422s. We still apply the Origin check
middleware to all state-changing routes (see main.py).

## Request body

- ConsumeCallbackReq
  - `token` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names.md) · [All operations](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names/llms.txt) · [OpenAPI document](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names/revisions/7228ffa1efa7?raw)