---
title: "Exchange a verified-email code for a credential"
method: POST
path: "/agent-auth/verified-email/claim"
---

# Exchange a verified-email code for a credential

`POST /agent-auth/verified-email/claim`

Auth.md verified_email flow, step 2. Returns a scoped bearer token the account owner can revoke at /settings/developer. Codes are single-use, expire in 15 minutes, and allow 5 attempts.

## Request body

- object
  - `email` string, required
  - `code` string, required — The 8-digit code from the email.

## Response `201`

access_token, token_type, scope, expires_at

## Other responses

- `400` — Invalid or expired code, or too many attempts

---

[API](https://skmtc.dev/once/apis/once-rest-api.md) · [All operations](https://skmtc.dev/once/apis/once-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/once/once-rest-api/revisions/6b7f882e04ff/schema)