discovery

Verify a code and mint an API key (step 2 of agent onboarding without a browser)

Public, unauthenticated. Verifies the code sent by POST /v1/auth/request-code and, on success, mints an API key through the same path POST /v1/api-keys uses — default scope manage. A new email provisions a personal organization first, exactly like every other sign-up path. An existing user's key is minted against their personal organization (the one they own, oldest first, if they belong to several). This does not set a session cookie — it mints a key, it does not log a browser in.

post/v1/auth/verify-code

Request

  • Base URL: https://postbag.dev
  • URL: https://postbag.dev/v1/auth/verify-code
  • Auth: none required

Request body

emailstring email required
codestring required

The 6-digit code from the email.

key_namestring

Defaults to "agent · <YYYY-MM-DD>".

scopesstring[]

Response

created

api_keystring required

Shown once — store it immediately.

key_idstring required
scopesstring[] required
nextstring[] required

Changes

No recorded changes to this operation across all 1 revision of this API.