---
title: "Verify magic link token (server-side)"
method: POST
path: "/auth/verify-token"
tags: ["authentication"]
---

# Verify magic link token (server-side)

`POST /auth/verify-token`

## Request

- Base URL: `https://api.whoisgeni.us` (the document declares no server; this is the origin it was published from)
- URL: `https://api.whoisgeni.us/auth/verify-token`
- Auth: none declared

Verify a magic link token server-side via Cognito admin API.

Rate-limited to 5 attempts per minute per IP to prevent brute-force.

## Request body

- VerifyTokenRequest: Request body for server-side magic link verification.
  - `email` string, required
  - `token` string, required

## Response `200`

Cognito tokens on success

- ApiResponseVerifyTokenResponse
  - `data` VerifyTokenResponse: Cognito tokens returned after successful magic link verification.
    - `id_token` string, required
    - `access_token` string, required
    - `refresh_token` string, required
  - `error` ErrorDetail: Structured error information for API error responses. Attributes: code: Machine-readable error code (e.g. "JOB_NOT_FOUND"). message: Human-readable error description. details: Optional additional context for debugging.
    - `code` string, required
    - `message` string, required
    - `details` object, nullable
  - `meta` object, nullable

## Other responses

- `401`: Unauthorized — missing or invalid API key/JWT.
- `422`: Validation Error

---

[API](https://skmtc.dev/whoisgeni/apis/whoisgenius.md) · [All operations](https://skmtc.dev/whoisgeni/apis/whoisgenius/llms.txt) · [OpenAPI document](https://skmtc.dev/whoisgeni/apis/whoisgenius/revisions/707f1c34f6b3?raw)