---
title: "Verify a code and mint an API key (step 2 of agent onboarding without a browser)"
method: POST
path: "/v1/auth/verify-code"
tags: ["discovery"]
---

# Verify a code and mint an API key (step 2 of agent onboarding without a browser)

`POST /v1/auth/verify-code`

## Request

- Base URL: `https://postbag.dev`
- URL: `https://postbag.dev/v1/auth/verify-code`
- Auth: none required

Public, unauthenticated. Verifies the code sent by POST /v1/auth/request-code and, on success, mints an API key through the same path POST /v1/api-keys uses — default scope manage. A new email provisions a personal organization first, exactly like every other sign-up path. An existing user's key is minted against their personal organization (the one they own, oldest first, if they belong to several). This does not set a session cookie — it mints a key, it does not log a browser in.

## Request body

- object
  - `email` string, email, required
  - `code` string, required: The 6-digit code from the email.
  - `key_name` string: Defaults to "agent · <YYYY-MM-DD>".
  - `scopes` string[]

## Response `201`

created

- object
  - `api_key` string, required: Shown once — store it immediately.
  - `key_id` string, required
  - `scopes` string[], required
  - `organization` object, required
    - `id` string, required
    - `slug` string, required
    - `name` string, required
  - `user` object, required
    - `email` string, required
    - `created` boolean, required
  - `next` string[], required

## Other responses

- `401`: Invalid or expired code

---

[API](https://skmtc.dev/postbag/apis/postbag-api.md) · [All operations](https://skmtc.dev/postbag/apis/postbag-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postbag/apis/postbag-api/revisions/3da976524695?raw)