Sign-in · verifyMagicLink

Sign in with a magic link

POST /api/auth/magic-link/verify

Spends the link (once) and signs in, creating the account when there is none; pending invitations for the email are accepted. The session token is in set-auth-token.

Who may call it: Anyone (no credentials)
Server: https://api.logu.dev

Request body#

Content type application/json (required).

The token from a magic link. Strict.

Field	Type	Required	Notes
`token`	`string`	required	16–200 chars

{
  "token": "q9XvT2mLp8RkW4nB6cYz1dHf3jS5aU7e"
}

Example#

curl -s -X POST "https://api.logu.dev/api/auth/magic-link/verify" \
  -H "Content-Type: application/json" \
  -d '{"token":"q9XvT2mLp8RkW4nB6cYz1dHf3jS5aU7e"}'

Responses#

200

Signed in.

{
  "intent": "sign-in",
  "newAccount": false,
  "passwordRemoved": false,
  "joined": []
}

Response fields

Field	Type	Required
`intent`	`"sign-in" \| "sign-up" \| "reset" \| "verify" \| "restore"`	required
`newAccount`	`boolean`	required
`passwordRemoved`	`boolean`	required
`joined`	`object[]`	required
`joined[].id`	`string`	required
`joined[].name`	`string`	required

Errors#

Every error is {"error":{"code","message","hint","docUrl","requestId"}}: branch on code. See Errors.

Status	Code	Meaning
400	`unknown_field`	The body has a field the endpoint doesn't know (often a typo or snake_case).
400	`bad_request`	The request is malformed or a field is invalid (see `issues`).
500	`internal_error`	Something went wrong on Logu's side.