---
title: "Consume a magic-link token and exchange it for an access token"
method: POST
path: "/auth/magic-link/consume"
tags: ["Auth"]
---

# Consume a magic-link token and exchange it for an access token

`POST /auth/magic-link/consume`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/auth/magic-link/consume`
- Auth: none declared

## Request body

- ConsumeMagicLinkDto
  - `token` string, required: Plaintext magic-link token from the email URL

## Response `200`

Token accepted, user marked verified, JWT issued

- APIAuthResponse
  - `accessToken` string, required: Bearer JWT access token
  - `user` APIUser, required
    - `id` string, required
    - `name` string, required
    - `email` string, required
    - `emailVerified` boolean, required
    - `role` 'user' | 'admin', required: Platform role. `admin` unlocks staff-only surfaces such as the /stats dashboard.
    - `createdAt` string, date-time, required
    - `signupRef` string, nullable, required: First-touch acquisition channel captured at signup (e.g. "cli", "mcp", "extension"). Null = organic/unattributed.

## Other responses

- `400`: Invalid or expired magic-link token

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)