---
title: "Start email sign-in (link or code)"
method: POST
path: "/oauth/email/start"
tags: ["OAuth"]
---

# Start email sign-in (link or code)

`POST /oauth/email/start`

## Request

- Base URL: `https://api.uptimemonitoring.com`
- URL: `https://api.uptimemonitoring.com/oauth/email/start`
- Auth: none required

Sends a sign-in email containing both a link (`{FRONTEND_URL}/signin/email#token=<tok>`,
the token lives only in the URL fragment, which keeps it out of the
landing-page request URL and ordinary access logs — verification
itself sends it to this API in a POST body, which the request
logger does not log) and a six-digit code, both valid for 10
minutes. Returns `202` with
an identical body for a known or unknown address — this endpoint
never reveals whether an address has signed in before.

Disabled unless `EMAIL_SIGNIN_ENABLED` is set at boot (`503` when
disabled). Rate limited per address, per caller IP, and with a
process-wide backstop; see `internal/api/DECISIONS.md` for the
exact values. `return_to` is honored only when it matches the
configured OAuth-bridge finalize prefix, mirroring
`/oauth/github/login`'s `return_to` handling.

## Request body

- object
  - `email` string, email, required
  - `return_to` string: Only honored when it matches the configured OAuth-bridge finalize prefix.

## Response `202`

Byte-identical for a known or unknown address.

- object
  - `status` string

## Other responses

- `400`: Invalid request.
- `413`: Request body exceeds the 64 KB hard limit. Per docs/SPEC.md §Hard Limits the dispatcher rejects any payload larger than 65,536 bytes before it is decoded.
- `415`: The request `Content-Type` is not `application/json`. Write operations (POST, PUT, PATCH) require that header; a missing or non-JSON media type is rejected before the body is read. The `charset` parameter is accepted and ignored, so `application/json; charset=utf-8` is valid.
- `429`: Rate limited (per address, per IP, or the process-wide backstop).
- `503`: Email sign-in disabled, or the transport (SendGrid) failed to send.

---

[API](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api.md) · [All operations](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/revisions/ddcb2a8bc70f?raw)