---
title: "Confirm a hosted email code"
method: POST
path: "/auth/email-code/confirm"
tags: ["Auth"]
---

# Confirm a hosted email code

`POST /auth/email-code/confirm`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/email-code/confirm`
- Auth: none declared

Same-origin hosted form/JSON ceremony. Resolves project, user, host, and return target from the challenge; caller-selected email, project, user, or redirect fields are rejected. Success sets the existing opaque host-only session cookie and returns 303 for forms or JSON for fetch clients.

## Request body

- object
  - `challenge_id` string, uuid, required
  - `code` string, required

## Response `200`

JSON success with redirect_to and Set-Cookie.

- object
  - `ok` true, required
  - `redirect_to` string, required

## Other responses

- `303`: Form success; redirects to the challenge-bound return target and sets the session cookie.
- `400`: Malformed request or caller-selected identity/redirect field.
- `401`: The well-formed code is invalid and the challenge still has attempts remaining.
- `403`: The hosted request failed same-origin enforcement.
- `410`: The challenge is exhausted or otherwise terminal; request a fresh email.
- `429`: Project, IP, or challenge verification rate limit exceeded; Retry-After is returned and no code attempt is consumed.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)