---
title: "Verify an emailed sign-in link"
method: GET
path: "/api/auth/magic-link/verify"
---

# Verify an emailed sign-in link

`GET /api/auth/magic-link/verify`

## Request

- Base URL: `https://www.toma.com`
- URL: `https://www.toma.com/api/auth/magic-link/verify`
- Auth: none required

Open the URL from the email in a browser. Establishes a session and redirects to callbackURL (or newUserCallbackURL for a new member). Invalid, expired, and reused links redirect with error=INVALID_TOKEN. Callback origins are checked by Better Auth. Without callbackURL, returns the session as JSON.

## Query parameters

- `token` string, required
- `callbackURL` string
- `newUserCallbackURL` string
- `errorCallbackURL` string

## Response `200`

The session when no callbackURL is supplied.

- object

## Other responses

- `302`: Redirect with a session cookie, or an error query parameter.
- `400`: Missing token.
- `403`: Untrusted callback.
- `404`: Email sign-in is not configured.
- `429`: Too many requests.

---

[API](https://skmtc.dev/toma/apis/toma-api.md) - [All operations](https://skmtc.dev/toma/apis/toma-api/llms.txt) - [OpenAPI document](https://skmtc.dev/toma/apis/toma-api/revisions/b4e56e1db5a2?raw)