# Verify the code (https://docs.loybox.com.ar/en/api-reference/autenticacion/verificar-codigo)



<Endpoint method="POST" path="/v1/auth/otp/verify" auth="none" />

Validates the code sent by email and returns the end user's session tokens.

If the email had no account, **it creates one**. Either way it leaves the user
subscribed to the program of the commerce named in `X-Commerce-Id`.

The `access` it returns is the one used as `Authorization: Bearer {access}` on
every [My account](https://docs.loybox.com.ar/api-reference/mi-cuenta) endpoint.

## Headers
<Fields>
  <Field name="X-Commerce-Id" type="integer" location="header" required="true">
    Id of the commerce integrating the API. Every response is scoped to this
    commerce.
  </Field>
</Fields>

## Body
<Fields>
  <Field name="email" type="string" required="true">
    The same email the
    [code was requested with](https://docs.loybox.com.ar/api-reference/autenticacion/pedir-codigo).
  </Field>

  <Field name="otp" type="string" required="true">
    The 6-digit code received by email. Exactly 6 characters.
  </Field>
</Fields>

## Response
A [Session](https://docs.loybox.com.ar/api-reference/objetos#sesión) object.

```bash
curl -X POST https://loybox-public-api-752998171300.southamerica-west1.run.app/v1/auth/otp/verify \
  -H "X-Commerce-Id: 87" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "ana@example.com",
    "otp": "418302"
  }'
```

```json
// 200 OK
{
  "access": "eyJhbGciOiJIUzI1NiIs...",
  "refresh": "eyJhbGciOiJIUzI1NiIs...",
  "expires_in": 3600,
  "user_id": 4821,
  "username": "Ana Pérez",
  "email": "ana@example.com",
  "phone": null
}
```

Store both tokens. The `access` expires in `expires_in` seconds; the `refresh` is
what later
[renews it](https://docs.loybox.com.ar/api-reference/autenticacion/renovar-token) without asking the user for
another code.

<Callout type="info" title="Verifying already subscribes the user">
  There is no need to call
  [join the program](https://docs.loybox.com.ar/api-reference/mi-cuenta/adherirme) after this: the user is
  already subscribed. That endpoint is for re-joining after opting out.
</Callout>

## Errors
| Code  | When                                                           |
| ----- | -------------------------------------------------------------- |
| `400` | The code is invalid or expired.                                |
| `422` | The `X-Commerce-Id` header is missing, or the body is invalid. |

After 5 failed attempts the code stops working and you have to
[request a new one](https://docs.loybox.com.ar/api-reference/autenticacion/pedir-codigo).