---
title: "Activate an account with its emailed code, and sign in"
method: POST
path: "/v1/auth/verify-code"
tags: ["Auth"]
---

# Activate an account with its emailed code, and sign in

`POST /v1/auth/verify-code`

## Request

- Base URL: `https://api.stackdata.io`
- URL: `https://api.stackdata.io/v1/auth/verify-code`
- Auth: one of:
  - none
  - API key in header `X-API-Key`

## Request body

- object
  - `email` string, email, required
  - `code` string, required: The 6-digit code.

## Response `200`

Activated and signed in.

- AuthSession: Returned by register/login. The `session` token also arrives as an httpOnly cookie.
  - `user` User: The signed-in user. Never includes the password hash or raw session.
    - `id` string
    - `nickname` string
    - `email` string: May be null for an OAuth-only account.
    - `email_verified` boolean
    - `avatar_seed` string: Seed for GET /v1/avatar/{seed}.
    - `has_password` boolean
    - `tier` string
    - `default_visibility` 'public' | 'private'
    - `providers` string[]: Linked OAuth providers.
    - `created_at` string
  - `session` string: Bearer token — send as Authorization for cross-origin calls.
  - `verify_token_dev` string: Dev-only — the email-verification token, present on non-https hosts since no mailer is wired.

## Other responses

- `400`: Invalid or expired code.
- `429`: Too many attempts; try again in a few minutes.

---

[API](https://skmtc.dev/stackdata/apis/stackdata-api.md) · [All operations](https://skmtc.dev/stackdata/apis/stackdata-api/llms.txt) · [OpenAPI document](https://skmtc.dev/stackdata/apis/stackdata-api/revisions/91358ae3f6e8?raw)