Verify an email address with an emailed token (gesture-consumed).
const url = 'https://api.tradr.cloud/api/auth/verify-email';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"token":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.tradr.cloud/api/auth/verify-email \ --header 'Content-Type: application/json' \ --data '{ "token": "example" }'Public. Rate limited by client IP (10 / 15 min, the login posture; token guessing is primarily throttled by the token’s 256-bit entropy + 24 h TTL). Atomically consumes the single-use verification token and marks the account email-verified in one transaction. Expired, already-consumed, and unrecognized tokens are indistinguishable: one generic 400 INVALID_OR_EXPIRED_TOKEN (REQ-5.3 — the frontend then offers the resend path). Consumption is THIS POST — fetching the emailed GET link never mutates, so prefetchers and link scanners burn nothing (D6, REQ-4.8). Fully functional when the instance has no email configured (D12 — consuming an existing token sends nothing).
Request Bodyrequired
Section titled “Request Bodyrequired”object
The raw token from the emailed link’s URL fragment.
Examplegenerated
{ "token": "example"}Responses
Section titled “Responses”{ success: true } — account marked email-verified, token consumed.
Validation error
Rate limit reached (IP-keyed).