---
title: "Start the passwordless authentication flow"
method: POST
path: "/blaize/token-exchange"
tags: ["Authentication"]
---

# Start the passwordless authentication flow

`POST /blaize/token-exchange`

## Request

- Base URL: `https://demo-site`
- URL: `https://demo-site/blaize/token-exchange`
- Auth: one of:
  - API key in cookie `blaize_session`
  - API key in query parameter `jwt`
  - API key in header `x-blaize-jwt`
  - API key in header `x-zephr-jwt`
  - HTTP bearer
  - API key in cookie `blaize_jwt`

Starts the passwordless authentication flow by sending an email to the user with a sign-in link. When the user clicks the link, they are directed to GET /blaize/token-exchange?token=..., which authenticates them automatically.
**IMPORTANT**: Passwordless authentication requires the user's email to be verified. This means the user must first receive a separate verification email and click the link to confirm their email address. Verification can be triggered by sending a POST request to the appropriate endpoint.

## Request body

- PasswordlessAuthenticationRequest
  - `identifiers` Identifiers, required
    - `email_address` string
  - `action` 'login' | 'register' | 'completeRegistration', required
  - `redirect` string: Either a relative path to the current site or a full URL for another site in the current tenant.

## Response `201`

Created

## Other responses

- `400`: Bad Request

---

[API](https://skmtc.dev/zuora/apis/zuora-2.md) - [All operations](https://skmtc.dev/zuora/apis/zuora-2/llms.txt) - [OpenAPI document](https://skmtc.dev/zuora/apis/zuora-2/revisions/678190d04c40?raw)