Sign in
auth

Verify Email

Redeem a signup verification link and continue into admission.

Rate Limited: 5 requests per minute per IP address.

Does not require authentication — the link is the credential, matching the account-setup redeem path. Each refusal gets its own status so the page can tell the user what to do next; none of them names an account.

post/api/v1/auth/verify-email

Request body

tokenstring required

Response

Successful Response

status'admitted' | 'preparing' | 'verification_required' | 'already_registered' required
account_idstring uuid nullable
intent'free' | 'paid'

What a public signup is asking for.

PAID is what a buyer arriving from the pricing page carries. It is not a funding fact — nothing is charged until checkout, and the workspace opens on the same joining grant a free signup gets — so it decides exactly one thing, and this is the one statement of it that the rest of the codebase points at rather than restates: the workspace records WorkspaceOrigin.DIRECT_PAID rather than SELF_SERVE_DISCOVERY, which is what routes the account to checkout.

It exempts nothing. Signup is unconditional, so there is no admission for a buyer to be exempt from, and every abuse gate binds either way — a verified address, the rate limits and the disposable-domain block.

It is therefore not a privilege worth stealing: everything it unlocks is reachable through the free door by anyone the paid door would admit.

Changes