---
title: "Proves the address: the calling email-less key sends back the code `POST /v1/keys/self/email` mailed. On success the address becomes this key's account's, and THIS key, and only this key, is lifted to `verified` on the free tier, which also unlocks offline downloads."
method: POST
path: "/v1/keys/self/email/verify"
tags: ["self-serve"]
---

# Proves the address: the calling email-less key sends back the code \`POST /v1/keys/self/email\` mailed. On success the address becomes this key's account's, and THIS key, and only this key, is lifted to \`verified\` on the free tier, which also unlocks offline downloads.

`POST /v1/keys/self/email/verify`

## Request

- Base URL: `https://api.mapmap.ai`
- URL: `https://api.mapmap.ai/v1/keys/self/email/verify`
- Auth: one of:
  - HTTP bearer
  - API key in query parameter `api_key`

Only the key that asked for the code can redeem it. An address that
already has ANY identity row is NEVER attached, whether or not anybody
ever verified it, and nothing moves between identities: the answer is
409 `email-in-use`. The app should then sign in with that address
through `POST /v1/keys`, which the owner's own mailbox verifies; that
is a new key on the address's identity, so the email-less key's own
state (its usage, styles and jobs) does not come with it. A wrong code counts against
[`identity::MAX_EMAIL_CODE_ATTEMPTS`] (then the code is void), and
attempts are capped per key and per IP per day like every other
verification budget.

## Request body

- VerifyEmailCodeRequest: Body for `POST /v1/keys/self/email/verify`.
  - `code` string, required: The code from the mail.

## Response `200`

Address attached; this key is now `verified` on the free tier

- VerifyEmailCodeResponse: Response for `POST /v1/keys/self/email/verify`.
  - `email` string, required: The address now on the account.
  - `monthly_quota` integer, required: Requests allowed per calendar month from now on.
  - `state` string, required: Always `verified`.

## Other responses

- `400`: Wrong, used, expired or voided code, or a code another key asked for
- `401`: Missing, unknown, revoked or expired key
- `409`: `key-has-email`: the key already has an email; `email-in-use`: the address belongs to another account, which is left untouched
- `429`: Per-key or per-IP daily attempt limit, or the key's per-minute rate limit

---

[API](https://skmtc.dev/mapmap/apis/sn-gateway.md) · [All operations](https://skmtc.dev/mapmap/apis/sn-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/mapmap/apis/sn-gateway/revisions/2293be8b4c38?raw)