Storyden
Auth

Auth Email Verify

Verify an email address using a token that was emailed to one of the account's email addresses either set via sign up or added later. The code is only six digits, so this endpoint MUST be rate limited to keep the search space out of reach of an unauthenticated caller.

POST/auth/email/verify

Verify an email address using a token that was emailed to one of the account's email addresses either set via sign up or added later.

The code is only six digits, so this endpoint MUST be rate limited to keep the search space out of reach of an unauthenticated caller.

Authorization

storyden-session<token>

In: cookie

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/auth/email/verify" \  -H "Content-Type: application/json" \  -d '{    "email": "hello@storyden.org",    "code": "728562"  }'
{
  "id": "string"
}
Empty
Empty
Empty
{
  "type": "string",
  "title": "string",
  "detail": "string",
  "trace_id": "string",
  "metadata": {}
}
Edit on GitHub

Auth Email Signup POST

Register a new account with an email and optional password. The password requirement is dependent on how the instance is configured for account authentication with email addresses (password vs magic link.) When the email address has not been registered, this endpoint will send a verification email however it will also return a session cookie to facilitate pre-verification usage of the platform. If the email address already exists, no session cookie will be returned in order to prevent arbitrary account control by a malicious actor. In this case, the email will be sent again with the same OTP for the case where the user has cleared their cookies or switched device but hasn't yet verified due to missing the email or a delivery failure. In this sense, the endpoint can act as a "resend verification email" operation as well as registration. In the first case, a 200 response is provided with the session cookie, in the second case, a 422 response is provided without a session cookie. Given that this is an unauthenticated endpoint that triggers an email to be sent to any public address, it MUST be heavily rate limited.

Auth Password Create POST

Given the requesting account does not have a password authentication, add a password authentication method to it with the given password.