---
title: "Verify a one-time code and mint a CLI API key"
method: POST
path: "/auth/otp/cli-exchange"
tags: ["auth"]
---

# Verify a one-time code and mint a CLI API key

`POST /auth/otp/cli-exchange`

## Request

- Base URL: `https://mbag.ai/api`
- URL: `https://mbag.ai/api/auth/otp/cli-exchange`
- Auth: none required

Same verification as `/auth/otp/verify`, but instead of a browser
session it returns a new `mbk_...` API key (named "CLI") for the
verified user. No cookie is set.

## Request body

- object
  - `code` string, required
  - `email` string, required

## Response `200`

Verified; API key issued.

- object
  - `api_key` string, required: Bearer key, prefixed `mbk_`.

## Other responses

- `401`: Code is wrong, expired, already used, or locked out.
- `500`: Database or internal error while verifying, or while creating the API key.

---

[API](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api.md) · [All operations](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api/revisions/fe2761823978?raw)