Agent Sessions

Verify a one-time code and mint a session

Verifies the WorkOS Magic Auth code from POST /api/auth/otp-request and mints both a browser session cookie (so this endpoint also serves the SPA) and a bearer agent session token, so an MCP agent can authenticate without ever holding a cookie. Runs the same new-account onboarding side effects as the browser OAuth callback. Never echoes the code.

post/api/auth/otp-verify

Request

  • Base URL: https://flint.network
  • URL: https://flint.network/api/auth/otp-verify
  • Auth: none required

Request body

emailstring email required
codestring required

The one-time code delivered to the inbox by /api/auth/otp-request.

labelstring

Optional human-readable label for the resulting session, such as the agent or workflow name.

Response

Signed in.

okboolean
session_tokenstring

Bearer agent session token ("flint_sess_" prefix). Pass it as Authorization: Bearer <session_token> on later calls. Treat it like a password; never log it.

expires_atstring date-time

Changes

No recorded changes to this operation across all 1 revision of this API.