---
title: "Verify an email sign-in link or code"
method: POST
path: "/oauth/email/verify"
tags: ["OAuth"]
---

# Verify an email sign-in link or code

`POST /oauth/email/verify`

## Request

- Base URL: `https://api.uptimemonitoring.com`
- URL: `https://api.uptimemonitoring.com/oauth/email/verify`
- Auth: none required

Accepts exactly ONE of two bodies: `{"token": "..."}` (the link's
fragment token) or `{"email", "code"}` (the six-digit code). Every
failure case — unknown, expired, wrong code, already consumed,
locked out after 5 wrong attempts, or malformed — returns the
identical `401` body, so a caller cannot distinguish them. There is
no GET route for this endpoint — a link scanner or prefetcher that
merely opens the emailed link cannot burn the challenge.

On success returns `redirect_to`, the same shape
`/oauth/github/callback` produces: either the dashboard's
`/callback?code=...` or, if the original `start` call's `return_to`
is still valid against the OAuth-bridge finalize prefix, that URL
with `?code=...` appended.

## Request body

- object
  - `token` string: The link's fragment token. Mutually exclusive with email/code.
  - `email` string, email
  - `code` string: Six-digit code. Requires email; mutually exclusive with token.

## Response `200`

Sign-in succeeded.

- object
  - `redirect_to` string, uri

## Other responses

- `401`: Invalid, expired, wrong, reused, locked, or malformed — identical body for every case.
- `403`: The resolved account is suspended.
- `413`: Request body exceeds the 64 KB hard limit. Per docs/SPEC.md §Hard Limits the dispatcher rejects any payload larger than 65,536 bytes before it is decoded.
- `415`: The request `Content-Type` is not `application/json`. Write operations (POST, PUT, PATCH) require that header; a missing or non-JSON media type is rejected before the body is read. The `charset` parameter is accepted and ignored, so `application/json; charset=utf-8` is valid.
- `429`: Rate limited (per caller IP, or the process-wide backstop).
- `503`: Email sign-in disabled.

---

[API](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api.md) · [All operations](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/revisions/ddcb2a8bc70f?raw)