Sign-in · peekMagicLink

See what a magic link does

POST /api/auth/magic-link/peek

The account a link signs in to, without spending it: the app shows it before the click (opening a link never signs in). removesSignInMethods warns that an unverified account loses the password and passkeys set before its email was verified. An account in its 30-day deletion grace only gets restore links (intent: "restore", deletionPurgeAt): clicking one cancels the deletion.

Who may call it: Anyone (no credentials)
Server: https://api.logu.dev

Request body#

Content type application/json (required).

The token from a magic link. Strict.

Field	Type	Required	Notes
`token`	`string`	required	16–200 chars

{
  "token": "q9XvT2mLp8RkW4nB6cYz1dHf3jS5aU7e"
}

Example#

curl -s -X POST "https://api.logu.dev/api/auth/magic-link/peek" \
  -H "Content-Type: application/json" \
  -d '{"token":"q9XvT2mLp8RkW4nB6cYz1dHf3jS5aU7e"}'

Responses#

200

What the link does.

{
  "email": "ana@example.com",
  "intent": "sign-in",
  "newAccount": false,
  "removesSignInMethods": false,
  "deletionPurgeAt": null
}

Response fields

Field	Type	Required	Notes
`email`	`string`	required
`intent`	`"sign-in" \| "sign-up" \| "reset" \| "verify" \| "restore"`	required
`newAccount`	`boolean`	required
`removesSignInMethods`	`boolean`	required
`deletionPurgeAt`	`string \| null`	required	date-time

Errors#

Every error is {"error":{"code","message","hint","docUrl","requestId"}}: branch on code. See Errors.

Status	Code	Meaning
400	`unknown_field`	The body has a field the endpoint doesn't know (often a typo or snake_case).
400	`bad_request`	The request is malformed or a field is invalid (see `issues`).
500	`internal_error`	Something went wrong on Logu's side.