Auth

Consume an email link opened in a browser that did not request it

Called by the SPA confirm page (/auth/email-link) after the human clicks Continue. Verifies and consumes the one-time token (a signup address is marked verified here), parks the verified identity in a sealed HttpOnly __Host-mnemom_email_link_pending cookie (10 min) and returns the MASKED account address. Issues NO session — POST /auth/email-link/confirm does, on an explicit confirm. Same-origin JSON only (login-CSRF guard).

post/auth/email-link/verify

Request

  • Base URL: https://api.mnemom.ai/v1
  • URL: https://api.mnemom.ai/v1/auth/email-link/verify
  • Auth: none required

Request body

token_hashstring required
type'signup' | 'recovery' | 'magiclink' | 'email_change' | 'invite' required
redirect_afterstring

Response

Token consumed; identity parked (or confirmed without a sign-in).

emailstring nullable required

Masked address of the account (e.g. j•••@acme.com); null when the link confirms without a sign-in.

type'signup' | 'recovery' | 'magiclink' | 'email_change' | 'invite' required
redirect_afterstring required
sign_inboolean required

Changes

No recorded changes to this operation across all 1 revision of this API.