Verify a Direct Auth email code.

POST

/api/v1/auth/direct/email-code/verify

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/v1/auth/direct/email-code/verify \
  --header 'Content-Type: application/json' \
  --data '{ "attempt_id": "attempt_123", "code": "123456", "code_verifier": "rfc7636-code-verifier", "channel": "browser" }'

Verifies the email code and returns a short-lived Direct Auth artifact bound to client, channel, provider, and PKCE metadata.

Request Body ^required

Media type application/json

object

attempt_id

required

string

code

required

string

code_verifier

required

string

channel

required

string

Allowed values: browser native

Example

{
  "attempt_id": "attempt_123",
  "code": "123456",
  "code_verifier": "rfc7636-code-verifier",
  "channel": "browser"
}

Responses

200

Successful JSON response.

Media type application/json

object

direct_auth_artifact

required

string

expires_in

required

integer

is_new_user

boolean

Example

{
  "direct_auth_artifact": "direct_auth_code_123",
  "expires_in": 60,
  "is_new_user": true
}

400

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}