---
title: "Verify a one-time code and start a browser session"
method: POST
path: "/auth/otp/verify"
tags: ["auth"]
---

# Verify a one-time code and start a browser session

`POST /auth/otp/verify`

## Request

- Base URL: `https://mbag.ai/api`
- URL: `https://mbag.ai/api/auth/otp/verify`
- Auth: none required

Verifies the code, sets the `mailbuttons_session` cookie
(HttpOnly, Strict, 7-day expiry), and returns where the dashboard
should redirect the browser next. Up to 5 wrong guesses are allowed
against a live code before every outstanding code for the email is
invalidated.

## Request body

- object
  - `code` string, required
  - `email` string, required

## Response `200`

Verified. Sets the session cookie.

- object
  - `redirect_to` string, required: `/dashboard` once onboarding is complete, else `/dashboard/welcome`.

## Other responses

- `401`: Code is wrong, expired, already used, or locked out.
- `500`: Database or internal error while verifying, creating the session, or provisioning the account.

---

[API](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api.md) · [All operations](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api/revisions/fe2761823978?raw)