Auth

Email-link landing (confirmation / recovery / magic link)

Landing for emailed auth links (signup confirmation, password recovery, magic link). Login-CSRF binding: the link only signs a browser in silently when that browser requested it — POST /auth/sign-up, /auth/resend-confirmation and /auth/password-reset-request set a sealed, HttpOnly __Host-mnemom_email_link cookie naming the recipient address. With that cookie present the token is verified and consumed; if the verified address matches, mnemom_session is issued as before. A browser with no binding is redirected to the SPA confirm page (/auth/email-link, token in the URL fragment) WITHOUT consuming the token, so a link-scanner prefetch cannot burn it. A bound browser opening a link for a different address gets no session: the verified identity is parked in a sealed __Host-mnemom_email_link_pending cookie (10 min) and the confirm page asks the human to confirm the (masked) account via POST /auth/email-link/confirm. An email link is a non-SSO login: when the confirmed email's domain belongs to an org that enforces SSO, no session is issued and the redirect goes to /login?notice=sso_required (or notice=sso_check_unavailable when that check cannot be completed); the confirm step refuses the same identity with 403 sso_required / 503 sso_check_unavailable.

get/auth/callback

Request

  • Base URL: https://api.mnemom.ai/v1
  • URL: https://api.mnemom.ai/v1/auth/callback
  • Auth: none required

Query parameters

token_hashstring required
type'signup' | 'recovery' | 'magiclink' | 'email_change' | 'invite' required
redirect_afterstring

Response

Not emitted by this Worker: the Worker always answers with a 302. When a client transparently follows that redirect, the SPA at the redirect target serves its HTML shell (text/html). Documented here so spec-conformance probes that follow the redirect don't flag the SPA landing page as an undocumented response.

Changes

No recorded changes to this operation across all 1 revision of this API.