---
title: "Exchange a one-time code for a session, unauthenticated"
method: POST
path: "/v1/auth/email/verify"
tags: ["auth"]
---

# Exchange a one-time code for a session, unauthenticated

`POST /v1/auth/email/verify`

## Request

- Base URL: `https://api.sixminute.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sixminute.ai/v1/auth/email/verify`
- Auth: none declared

Redeems the code with WorkOS and returns exactly what the device's own PKCE exchange returns, so the daemon stores it through one code path. A wrong code is a 422 `invalid-code`, an expired one a 422 `code-expired`, too many attempts a 429 `rate-limited`. A person in more than one organisation is signed in to their one firm, never the operators organisation; none is a 403 `no-firm` and more than one a 403 `choose-firm`.

## Request body

- object
  - `email` string, email, required
  - `code` string, required

## Response `200`

The session: the tokens and the user.

- object
  - `access_token` string, required
  - `refresh_token` string, required
  - `organization_id` string, nullable
  - `user` object, required
    - `id` string, required
    - `email` string, required
    - `first_name` string, nullable
    - `last_name` string, nullable

## Other responses

- `400`: The body, query or path did not validate; `errors` lists the fields.
- `403`: The token verified but may not do this: no organisation, not provisioned, wrong role, or a device problem.
- `422`: The request is well-formed but cannot be carried out as it stands.
- `429`: Too many requests; `Retry-After` says how long to wait.
- `502`: An upstream this service depends on failed or answered nonsense.
- `503`: A capability this service was not configured with, or a practice system that could not be reached; the `type` says which.

---

[API](https://skmtc.dev/sixminute/apis/sixminute-api.md) - [All operations](https://skmtc.dev/sixminute/apis/sixminute-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sixminute/apis/sixminute-api/revisions/605577eadc10?raw)