---
title: "Start a passwordless email-code ceremony"
method: POST
path: "/auth/otp/start"
tags: ["Auth"]
---

# Start a passwordless email-code ceremony

`POST /auth/otp/start`

## Request

- Base URL: `https://api.medianfi.com/api/v1`
- URL: `https://api.medianfi.com/api/v1/auth/otp/start`
- Auth: none required

Available only while ONBOARDING_V3_ENABLED is true. Signin remains enumeration resistant. Signup explicitly returns existingAccount=true for an existing Median account without issuing or delivering a code.

## Headers

- `X-Median-App-Surface` 'qa'

## Request body

- PasswordlessOtpStartInput
  - `email` string, email, required
  - `purpose` 'signup' | 'signin', required
  - `fullName` string
  - `recaptchaToken` string, required

## Response `200`

Request accepted; signup may explicitly report an existing account

- PasswordlessOtpStartResponse
  - `success` true, required
  - `data` object, required
    - `accepted` true, required
    - `resendAfterSeconds` 30, required
    - `existingAccount` true: Present only for purpose=signup when the account already exists; no OTP is stored or delivered in this branch.

## Other responses

- `400`: Request body is not valid JSON
- `403`: reCAPTCHA verification is required, unavailable, or failed
- `404`: Onboarding v3 is disabled; the route is hidden
- `413`: Request body exceeds the passwordless route limit
- `415`: Request body charset or content encoding is unsupported
- `422`: Validation error
- `429`: Retry after the indicated number of seconds

---

[API](https://skmtc.dev/medianfi/apis/median-api.md) · [All operations](https://skmtc.dev/medianfi/apis/median-api/llms.txt) · [OpenAPI document](https://skmtc.dev/medianfi/apis/median-api/revisions/20090ea32b0d?raw)