Public

Exchange a magic-link token for an access token (passwordless login).

Call this with the magicToken carried by the link from a "magic link" email (requested via POST /api/v1/crm/people/requestMagicLink):

{ "magic_token": "eyJ..." }

The link proves control of the email inbox, which satisfies the first factor. The response then matches POST /api/v1/tokens:

200 with an access token when no further factor is required;
202 with a two_factor_required challenge when the user has a non-email second factor (e.g. an authenticator app) that must still be cleared via POST /api/v1/tokens/two-factor. Email is never offered as that second factor — it was already the first.

An invalid, expired, already-used token (or a tenant without magic-link login enabled) returns 400 (invalid_grant).

post/api/v1/tokens/magic-link

Request

Base URL: https://go.outseta.com
URL: https://go.outseta.com/api/v1/tokens/magic-link
Auth: none declared

Query parameters

dataunknown required

Response

The link was valid; the access token (JWT) is returned.

access_tokenstring nullable

authentication_callback_urlstring nullable

expires_ininteger

id_tokenstring nullable

refresh_tokenstring nullable

token_typestring nullable

Example response

{
  "access_token": "string",
  "authentication_callback_url": "string",
  "expires_in": 0,
  "id_token": "string",
  "refresh_token": "string",
  "token_type": "string"
}

Changes

No recorded changes to this operation across all 1 revision of this API.