---
title: "Verify a one-time code and mint a session"
method: POST
path: "/api/auth/otp-verify"
tags: ["Agent Sessions"]
---

# Verify a one-time code and mint a session

`POST /api/auth/otp-verify`

## Request

- Base URL: `https://flint.network`
- URL: `https://flint.network/api/auth/otp-verify`
- Auth: none required

Verifies the WorkOS Magic Auth code from POST /api/auth/otp-request and mints both a browser session cookie (so this endpoint also serves the SPA) and a bearer agent session token, so an MCP agent can authenticate without ever holding a cookie. Runs the same new-account onboarding side effects as the browser OAuth callback. Never echoes the code.

## Request body

- OtpVerifyRequest
  - `email` string, email, required
  - `code` string, required: The one-time code delivered to the inbox by /api/auth/otp-request.
  - `label` string: Optional human-readable label for the resulting session, such as the agent or workflow name.

## Response `200`

Signed in.

- OtpVerifyResponse
  - `ok` boolean
  - `session_token` string: Bearer agent session token ("flint_sess_" prefix). Pass it as Authorization: Bearer <session_token> on later calls. Treat it like a password; never log it.
  - `expires_at` string, date-time
  - `user` object
    - `id` string
    - `email` string, email
    - `email_verified` boolean

## Other responses

- `400`: otp_invalid.
- `429`: otp_rate_limited, with reason "ip" or "provider".
- `502`: auth_provider_error.
- `503`: auth_not_configured.

---

[API](https://skmtc.dev/flint/apis/flint-agent-transaction-control-api.md) · [All operations](https://skmtc.dev/flint/apis/flint-agent-transaction-control-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flint/apis/flint-agent-transaction-control-api/revisions/eb5052b7b5dc?raw)