---
title: "Oauth Confirm Link"
method: POST
path: "/v1/auth/oauth/confirm-link"
tags: ["auth-oauth"]
---

# Oauth Confirm Link

`POST /v1/auth/oauth/confirm-link`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/auth/oauth/confirm-link`
- Auth: none declared

Finalize a link_required handoff.

The callback handed the browser a short ticket because the OAuth email
matched an existing account that had no identity bound for this provider.
The user re-authenticated through any pre-existing factor (password or
already-linked OAuth) and POSTs back here with the ticket. We require
that the authenticated principal matches the ticket's user_uuid — this
is the security gate that prevents account-takeover via provider-side
email reassignment.

## Request body

- ConfirmLinkIn
  - `ticket` string, required

## Response `204`

Successful Response

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)