---
title: "The emailed link's landing page. **Opening it changes nothing** (review of #1339, H1): mail security scanners and a single stray click open links, so a link that confirmed on GET could confirm a key a stranger asked for. The page shows the request (the app it said it came from, or that it named none, the time and the device class; no location is recorded) and confirms or refuses only on an explicit button, which POSTs to [`confirm_key`] or [`deny_key`]."
method: GET
path: "/v1/keys/verify"
tags: ["self-serve"]
---

# The emailed link's landing page. \*\*Opening it changes nothing\*\* (review of #1339, H1): mail security scanners and a single stray click open links, so a link that confirmed on GET could confirm a key a stranger asked for. The page shows the request (the app it said it came from, or that it named none, the time and the device class; no location is recorded) and confirms or refuses only on an explicit button, which POSTs to \[\`confirm_key\`\] or \[\`deny_key\`\].

`GET /v1/keys/verify`

## Request

- Base URL: `https://api.mapmap.ai`
- URL: `https://api.mapmap.ai/v1/keys/verify`
- Auth: none declared

Links carry the token in the fragment (`#t=`), which never reaches this
server; the page's script reads it. Links sent before carry `?token=`
and land on the same page. With `Accept: application/json` (an agent
relaying a link) the answer is the same facts as
`POST /v1/keys/verify/details`, and nothing is consumed either.

## Query parameters

- `token` string

## Response `200`

The confirmation page (HTML), or with `Accept: application/json` and a `token` the request facts. Nothing is confirmed or consumed

- VerifyDetailsResponse: What the confirmation page shows before anyone presses a button.
  - `kind` string, required: `"new-signup"` when nobody has verified the address yet (the welcome mail), `"new-key-on-account"` when the address already has a verified key (the owner notice).
  - `request` KeyRequestView, required: What the owner is shown about one key request.
    - `app` string, nullable: The MapMap app the request SAID it came from (its label is one of the apps'), or `null` for any other label, which is never repeated.
    - `device` string, required: Coarse device class read from the user agent.
    - `requested_at` string, required: RFC 3339 time the key was requested.
    - `requested_at_text` string, required: The same time in words, UTC: "1 October 2026 at 14:05 UTC".
    - `source` string, required: One sentence for a person: "The request said it came from the MapMap Nav app." or "The request did not say which app it came from."
  - `state` string, required: The key's state: `provisional` until confirmed, `verified` once it is.

## Other responses

- `400`: JSON only: missing, unknown, used or expired token

---

[API](https://skmtc.dev/mapmap/apis/sn-gateway.md) · [All operations](https://skmtc.dev/mapmap/apis/sn-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/mapmap/apis/sn-gateway/revisions/2293be8b4c38?raw)