Skip to content

Verify an email address with an emailed token (gesture-consumed).

POST
/api/auth/verify-email
curl --request POST \
--url https://api.tradr.cloud/api/auth/verify-email \
--header 'Content-Type: application/json' \
--data '{ "token": "example" }'

Public. Rate limited by client IP (10 / 15 min, the login posture; token guessing is primarily throttled by the token’s 256-bit entropy + 24 h TTL). Atomically consumes the single-use verification token and marks the account email-verified in one transaction. Expired, already-consumed, and unrecognized tokens are indistinguishable: one generic 400 INVALID_OR_EXPIRED_TOKEN (REQ-5.3 — the frontend then offers the resend path). Consumption is THIS POST — fetching the emailed GET link never mutates, so prefetchers and link scanners burn nothing (D6, REQ-4.8). Fully functional when the instance has no email configured (D12 — consuming an existing token sends nothing).

Media typeapplication/json
object
token
required

The raw token from the emailed link’s URL fragment.

string
/^[0-9a-f]{64}$/
Examplegenerated
{
"token": "example"
}

{ success: true } — account marked email-verified, token consumed.

Validation error

Rate limit reached (IP-keyed).