Skip to main content
POST
Start an authentication attempt

Headers

Idempotency-Key
string
required

Use an unpredictable unique key, such as a UUID, for each new attempt. Retrying with the same key and body returns the same attempt without sending another email. For the same email, the same key with a different body is a 422.

Required string length: 1 - 128

Body

application/json
email
string<email>
required

Address to send the verification code to. It may belong to an existing account or a new one.

Maximum string length: 254
Example:

"owner@example.com"

keyName
string
required

Name of the API key issued when verification succeeds.

Required string length: 1 - 64
Example:

"laptop-cli"

codeChallenge
string
required

Unpadded base64url SHA-256 hash of a random codeVerifier the caller keeps private. Verify and resend require the matching verifier.

Pattern: ^[A-Za-z0-9_-]{43}$
Example:

"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"

Response

Created. A verification code was emailed.

attemptId
string
required

Identifies the attempt in verify and resend.

Example:

"att_3kq9x81mzp"

expiresAt
string<date-time>
required

When the attempt stops accepting codes. Resending does not extend it.

Example:

"2026-10-16T18:10:00Z"

resendAfter
string<date-time>
required

Earliest time a resend is accepted.

Example:

"2026-10-16T18:00:30Z"

Last modified on November 10, 2026