Verify the code

POST/v1/auth/otp/verifyNo token

Validates the code sent by email and returns the end user's session tokens.

If the email had no account, it creates one. Either way it leaves the user subscribed to the program of the commerce named in X-Commerce-Id.

The access it returns is the one used as Authorization: Bearer {access} on every My account endpoint.

Headers

X-Commerce-Idintegerheaderrequired

Id of the commerce integrating the API. Every response is scoped to this commerce.

Body

emailstringrequired

The same email the code was requested with.

otpstringrequired

The 6-digit code received by email. Exactly 6 characters.

Response

A Session object.

curl -X POST https://loybox-public-api-752998171300.southamerica-west1.run.app/v1/auth/otp/verify \
  -H "X-Commerce-Id: 87" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "ana@example.com",
    "otp": "418302"
  }'

// 200 OK
{
  "access": "eyJhbGciOiJIUzI1NiIs...",
  "refresh": "eyJhbGciOiJIUzI1NiIs...",
  "expires_in": 3600,
  "user_id": 4821,
  "username": "Ana Pérez",
  "email": "ana@example.com",
  "phone": null
}

Store both tokens. The access expires in expires_in seconds; the refresh is what later renews it without asking the user for another code.

Verifying already subscribes the user

There is no need to call join the program after this: the user is already subscribed. That endpoint is for re-joining after opting out.

Errors

Code	When
`400`	The code is invalid or expired.
`422`	The `X-Commerce-Id` header is missing, or the body is invalid.

After 5 failed attempts the code stops working and you have to request a new one.

Headers

Body

Response

Errors

On this page