Auth

Consume Magic Link

Exchange a magic-link token for a session JWT.

Magic-link replaces the password factor, not the MFA challenge (see docs/auth/MFA.md §"Magic-link interaction"). The response mirrors /login's discriminated union:

  • kind: "session" — user has no active MFA. A full session JWT with mfa_satisfied=false is returned. Extranet routes still bounce these tokens off get_admin_user / get_property_admin_user once enforcement is on; guest users sail through.
  • kind: "mfa_required" — user has at least one active MFA method. A 5-minute mfa_challenge_token is returned and must be exchanged at /auth/mfa/verify-login for a real session. This is the path that prevents a magic-linked admin from being redirected to /account/security?reason=mfa_required despite already having MFA configured.
post/auth/magic-link/consume

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/auth/magic-link/consume
  • Auth: none declared

Headers

API-Version'1'

Major API version. Omit or send 1 for the current v1 surface. Retired operations use RFC 9745 Deprecation and RFC 8594 Sunset headers.

Request body

tokenstring required

Response

Successful Response

OR

Changes

No recorded changes to this operation across all 1 revision of this API.