STstatable
Bootstrap

Consume the code and receive the first API key

Verifies the code, creates the account if the address is new, records the terms acceptance, and returns a freshly minted key — the raw token EXACTLY ONCE. accept_terms must be true. Requested scopes must be within API_BOOTSTRAP_SCOPES (default read,sites:write); omitting them yields that whole set, and billing:write is never obtainable here. Everything that can be rejected without the code is validated first, so a bad field does not burn a valid code. The key is always all-sites and always expires (90 days by default, 365 max).

post/auth/verify-otp

Request

Request body

emailstring email required
codestring required

The code from the email. Single-use; three wrong guesses destroy it.

accept_termsboolean required

Must be true. Recorded server-side with the version, channel api, IP and User-Agent as the account's acceptance evidence.

terms_versionstring

The version being accepted. Defaults to the server's current version.

key_namestring
scopesstring[]

Must be within API_BOOTSTRAP_SCOPES (default read,sites:write). Omitted = that whole set. billing:write is never available here.

expires_in_daysinteger

Example request

{
  "code": "123456",
  "terms_version": "2026-07-01"
}

Response

The account and its first key, including the one-time token.

tokenstring required

The raw bearer token, returned exactly once.

createdboolean required

True when this call registered a new account; false when the address already had one and simply received an additional key.

Example response

{
  "token": "stbl_Z9y8X7w6…",
  "key": {
    "prefix": "stbl_A1b2C3d4",
    "scopes": "read"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.