---
title: "Discover API region from a peppered email hash"
method: POST
path: "/auth/region"
tags: ["oauth"]
---

# Discover API region from a peppered email hash

`POST /auth/region`

Hash-only discovery hop for shared-app login. Clients send HMAC-SHA256 hex of the normalized email. A US reservation returns region=us. A miss returns region=ca. Never send raw email. Does not return a URL.

## Request body

- AuthRegionLookupRequest
  - `email_hash` string, required — HMAC-SHA256 peppered email hash as 64 hex chars. Raw email is rejected.

## Response `200`

region for this hash

- AuthRegionLookupResponse
  - `region` 'ca' | 'us', required

## Other responses

- `400` — invalid body (raw email or bad hash)
- `429` — rate limited

## Changes

- **2026-09-19** `2991fb51502d` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/changes/auth/region/post.md)

---

[API](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server.md) · [All operations](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/llms.txt) · [OpenAPI document](https://skmtc.dev/rxfoodapp/apis/inneranalytics-mnt-server/revisions/750cc0d96a93?raw)