---
title: "Our sign-in page proves the person and asks for an app's one-time code, unauthenticated"
method: POST
path: "/v1/auth/authorize"
tags: ["auth"]
---

# Our sign-in page proves the person and asks for an app's one-time code, unauthenticated

`POST /v1/auth/authorize`

## Request

- Base URL: `https://api.sixminute.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sixminute.ai/v1/auth/authorize`
- Auth: none declared

Requires `X-Six-Minute-Page: 1` from an Origin this service serves (403 otherwise). Proves the person by the emailed code (`method: email`, with the email verify route's limits and refusals) or by WorkOS's code with the page's own verifier (`method: workos`, a wrong verifier is 422 `invalid-code`). Answers an `sma_` code that works once, for 60 seconds, at `POST /v1/auth/token` with the verifier of `code_challenge` for `client`. A person nobody invited is 403 `no-firm`; one in several firms gets a code all the same, and the token endpoint answers the choice. Rate limited per caller.

## Request body

- union
  - object
    - `method` 'email', required
    - `client` 'desktop' | 'phone', required
    - `code_challenge` string, required
    - `email` string, required
    - `code` string, required
  - object
    - `method` 'workos', required
    - `client` 'desktop' | 'phone', required
    - `code_challenge` string, required
    - `code` string, required
    - `code_verifier` string, required

## Response `200`

The one-time code.

- object
  - `code` string, required

## Other responses

- `400`: The body, query or path did not validate; `errors` lists the fields.
- `403`: The token verified but may not do this: no organisation, not provisioned, wrong role, or a device problem.
- `422`: The request is well-formed but cannot be carried out as it stands.
- `429`: Too many requests; `Retry-After` says how long to wait.
- `502`: An upstream this service depends on failed or answered nonsense.
- `503`: A capability this service was not configured with, or a practice system that could not be reached; the `type` says which.

## Changes

- **2026-11-04** `605577eadc10`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/sixminute/apis/sixminute-api/changes/v1/auth/authorize/post.md)

---

[API](https://skmtc.dev/sixminute/apis/sixminute-api.md) - [All operations](https://skmtc.dev/sixminute/apis/sixminute-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sixminute/apis/sixminute-api/revisions/605577eadc10?raw)