---
title: "Verify a passwordless email code and issue a session"
method: POST
path: "/auth/otp/verify"
tags: ["Auth"]
---

# Verify a passwordless email code and issue a session

`POST /auth/otp/verify`

## Request

- Base URL: `https://api.medianfi.com/api/v1`
- URL: `https://api.medianfi.com/api/v1/auth/otp/verify`
- Auth: none required

## Headers

- `X-Median-App-Surface` 'qa'

## Request body

- PasswordlessOtpVerifyInput
  - `email` string, email, required
  - `purpose` 'signup' | 'signin', required
  - `code` string, required
  - `recaptchaToken` string, required

## Response `200`

Code verified and session issued

- PasswordlessSessionResponse
  - `success` true, required
  - `data` object, required
    - `user` User, required
      - `id` string, uuid
      - `email` string, email
      - `name` string
      - `phone` string, nullable
      - `jobTitle` string, nullable
      - `createdAt` string, date-time
      - `updatedAt` string, date-time
    - `accessToken` string, required
    - `refreshToken` string, required
    - `expiresIn` integer, required
    - `isNewUser` boolean, required
    - `companyId` string, uuid, nullable, required
    - `canSeeInternalUi` boolean, required
    - `featureFlags` object, required
    - `memberships` UserContextMembership[], required
      - `companyId` string, uuid
      - `companyName` string, nullable
      - `role` 'owner' | 'admin' | 'cfo' | 'member' | 'viewer'

## Other responses

- `400`: Request body is not valid JSON
- `401`: The credential or one-shot ceremony is invalid, expired, or already used
- `403`: reCAPTCHA verification is required, unavailable, or failed
- `404`: Onboarding v3 is disabled; the route is hidden
- `409`: The signup email became an existing account after code issuance (PASSWORDLESS_ACCOUNT_EXISTS); no session is issued.
- `413`: Request body exceeds the passwordless route limit
- `415`: Request body charset or content encoding is unsupported
- `422`: Validation error
- `429`: Retry after the indicated number of seconds

---

[API](https://skmtc.dev/medianfi/apis/median-api.md) · [All operations](https://skmtc.dev/medianfi/apis/median-api/llms.txt) · [OpenAPI document](https://skmtc.dev/medianfi/apis/median-api/revisions/20090ea32b0d?raw)