Auth

Request passwordless email authentication

Requests link, code, or both delivery for sign-in, invite, claim, or recovery. delivery defaults to link. redirect_url is required for link/both and optional for code. A syntactically valid anonymous request receives generic accepted wording regardless of account existence; acceptance does not claim provider delivery. code/both returns only an opaque challenge_id, never the code. intent=invite requires a service key and produces trusted state.

post/auth/v1/magic-link

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/auth/v1/magic-link
  • Auth: one of:
    • API key in header apikey
    • API key in header apikey and HTTP bearer

Request body

emailstring email required
redirect_urlstring uri

URL to redirect to with ?token=<token>. Must be an allowed origin for this project and must be served by a document that exchanges the token. If the active release serves this path through a GET static route alias, the 200 response includes a MAGIC_LINK_REDIRECT_STATIC_ALIAS warning.

delivery'link' | 'code' | 'both'

Credential(s) included in the email. redirect_url is required for link/both.

intent'signin' | 'invite' | 'claim' | 'recovery'
client_stateunknown

Response

Request accepted. code/both may include an opaque challenge_id; warnings are preserved.

messagestring required
challenge_idstring uuid

Opaque public handle returned for accepted code/both requests. Never the emailed code.

Example response

{
  "message": "Email authentication request accepted."
}

Changes

No recorded changes to this operation across all 1 revision of this API.