---
title: "Check a SponsorUnited email and password for the MCP sign-in"
method: POST
path: "/api/mcp-auth/verify-credentials"
tags: ["MCP Auth"]
---

# Check a SponsorUnited email and password for the MCP sign-in

`POST /api/mcp-auth/verify-credentials`

## Request

- Base URL: `https://api.sponsorunited.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sponsorunited.com/api/mcp-auth/verify-credentials`
- Auth: API key in header `X-API-Key`
- TypeScript: <https://skmtc.dev/sponsorunited/apis/sponsorunited-api/docs/api/mcp-auth/verify-credentials/post.ts> (a function with typed inputs; its response is checked against the schema)

Called by the Cognito migrate-user Lambda with its own key (X-API-Key, MCP_SIGN_IN_API_KEY_TOKEN), which works on this endpoint only. Starts no session: no token, no session cache entry, no last-active write. Only 200 lets the user in. Every refusal (unknown email, wrong password, deleted, unverified, password reset pending, no use-mcp permission, no organization) is the same 401 {"error": "Invalid credentials"}; the reason goes only to the auth log. 401 {"status": "Invalid API key"} means the key is missing, wrong or another service's: a configuration error, not a user refusal. A few calls a minute per email (the Pro login retry limit) and an overall cap; the next gets 429 with Retry-After.

## Request body

- VerifyMcpCredentialsRequest
  - `email` string, email, required: Email of the SponsorUnited user. Case of the letters A-Z and surrounding spaces are ignored; any other spelling (accents, full-width or other look-alike letters) is refused like an unknown email.
  - `password` string, password, required: The user's SponsorUnited password, sent as typed.

## Response `200`

The credentials are valid and the user may use MCP.

- object
  - `user_id` integer, required
  - `organization_id` integer, required

## Other responses

- `401`: Either {"error": "Invalid credentials"} (the user is refused) or {"status": "Invalid API key"} (the key is missing, wrong or another service's, or a user token was sent instead).
- `422`: Validation error: {"error": "<first message>"}.
- `429`: Too many attempts in a minute, for this email or for all MCP sign-in checks together. Retry-After says when to retry.

---

[API](https://skmtc.dev/sponsorunited/apis/sponsorunited-api.md) - [All operations](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/revisions/cbf1ca5bff8f?raw)