1. Docs
  2. API Reference
  3. OAuth hosted login: verify the passwordless login code

OAuth hosted login: verify the passwordless login code

POST/oauth/login/email-otp/verify

Step 2 of the hosted passwordless email-OTP login: verifies the emailed code. On success it runs the shared MFA gate (trusted-device short-circuit, then challenge / enrollment / grace as required) with primary amr of ["otp"], mints an authorization code, and consumes the single-use login code. On failure it re-renders the code-entry view with a generic error. Throttled to 10 requests per 10 minutes.

Request body

application/json

emailstring Required
client_idstring Required
redirect_uristring Required
response_typestring Required
scopestring Required
statestring Optional
code_challengestring Required
code_challenge_methodstring Required
codestring Required

The 6-digit login code received via email.

remember_deviceboolean Optional

Responses

200
Request
curl -X POST "https://auth.canopy-io.com/oauth/login/email-otp/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "string",
    "client_id": "string",
    "redirect_uri": "string",
    "response_type": "string",
    "scope": "string",
    "state": "string",
    "code_challenge": "string",
    "code_challenge_method": "string",
    "code": "123456",
    "remember_device": false
  }'
Response
HTTP/1.1 200

(empty body)
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy