Auth

Redeem a sign-in code

Exchanges an emailed code for a session, creating the account if the address is new. The code is single-use and short-lived. A code is destroyed after too many wrong guesses, since six digits is small enough to guess given unlimited attempts — the client must then request a new one rather than retry.

post/v1/auth/code/verify

Request

  • Base URL: https://api.naturali.ai
  • URL: https://api.naturali.ai/v1/auth/code/verify
  • Auth: none required

Request body

emailstring email required
codestring required

The code from the email, as sent — digits only.

Example request

{
  "email": "ana@acme.com",
  "code": "481902"
}

Response

Authenticated; a session is returned.

token_type'Bearer' required
access_tokenstring required

Short-lived access JWT. Send as Authorization: Bearer <token>.

expires_ininteger required

Access-token lifetime in seconds.

refresh_tokenstring

Single-use refresh token, rotated on every refresh.

Example response

{
  "token_type": "Bearer",
  "access_token": "eyJhbGciOiJIUzI1NiJ9...",
  "expires_in": 900,
  "refresh_token": "rt_9f2StGXR8Z5jdHi6B...",
  "user": {
    "id": "user_V1StGXR8Z5jdHi6B",
    "email": "ana@acme.com",
    "name": "Ana Silva",
    "email_verified": true,
    "roles": [],
    "usage_alerts": true,
    "created_at": "2026-07-17T00:00:00.000Z"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.