---
title: "Request hosted passwordless email sign-in"
method: POST
path: "/auth/magic-link/send"
tags: ["Auth"]
---

# Request hosted passwordless email sign-in

`POST /auth/magic-link/send`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/magic-link/send`
- Auth: none declared

Hosted ceremony resolved by request host (no credential). delivery defaults to link; code/both returns an opaque challenge_id after accepted/captured delivery and HTML clients receive a same-tab confirmation form. Non-enumerating: acceptance never discloses whether the email maps to a user or claims provider delivery. Rate-limited per project/email/IP/tier.

## Request body

- object
  - `email` string, email, required
  - `return_to` string: Relative path or same-origin URL to land on after sign-in. The hosted route continues to accept the legacy returnTo spelling for compatibility.
  - `delivery` 'link' | 'code' | 'both'

## Response `200`

Generic accepted acknowledgement; code/both includes challenge_id only after accepted/captured delivery.

- object

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)