auth

Mint the key — only fires from a real human click, never a prefetch

Step 3 — the actual mint. Only reachable via GET /verify's confirm-page JS, triggered by a real button click; a scanner's automatic prefetch of the emailed link never reaches this endpoint, so it can't burn the token before the human sees it. plaintext_key is returned exactly once here and never again — nothing else in the API can retrieve it after this response.

post/v1/auth/verify/confirm

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/v1/auth/verify/confirm
  • Auth: none required

Request body

tokenstring required

Magic-link token from the emailed verify URL

Response

Successful Response

status'minted' | 'already_issued' | 'invalid' | 'used' | 'expired' required
plaintext_keystring nullable
emailstring nullable
key_idstring nullable
key_hintstring nullable

Changes

No recorded changes to this operation across all 1 revision of this API.