---
title: "Confirm an email address (consume the verification token)"
method: POST
path: "/api/auth/verify-email"
tags: ["Mutations"]
---

# Confirm an email address (consume the verification token)

`POST /api/auth/verify-email`

## Request

- Base URL: `https://rrmacademy.org`
- URL: `https://rrmacademy.org/api/auth/verify-email`
- Auth: none required

Magic-link branch: submit the token as `application/x-www-form-urlencoded` (field `token`). On success the single-use token is consumed, the user is marked verified, a session is minted, and the response is a 303 redirect to /account/ with Set-Cookie. A dormant legacy branch accepts `application/json` `{ "code": "..." }` with an authenticated session cookie and returns `{ "ok": true }`. Rate limited (20 form attempts / 15 min per IP).

## Request body

- object
  - `code` string, required: Legacy typed verification code (dormant fallback; requires an authenticated session).

## Response `200`

Legacy JSON branch succeeded, or the link was already used.

- AuthSuccess
  - `ok` true, required

## Other responses

- `303`: Magic-link branch succeeded: redirect to /account/ with session cookies set.
- `400`: Malformed token (HTML) or invalid legacy code/JSON (JSON AuthError).
- `401`: Legacy branch: no authenticated session.
- `410`: Verification token expired (HTML page).
- `429`: Too many verification attempts.

---

[API](https://skmtc.dev/rrmacademy/apis/rrm-academy-agent-api.md) · [All operations](https://skmtc.dev/rrmacademy/apis/rrm-academy-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rrmacademy/apis/rrm-academy-agent-api/revisions/0e3589a38b0c?raw)