Skip to content
EdgeKit

Consume a magic-link token

POST
/v1/id/magic-link/consume
curl --request POST \
  --url https://your-tenant-host/v1/id/magic-link/consume \
  --header 'Content-Type: application/json' \
  --header 'x-edgekit-site-id: site_example' \
  --data '{ "token": "q1w2e3r4", "callbackURL": "/account" }'

The token is the credential, so no session is required. It is a POST behind an interstitial because mail scanners GET emailed links, and a token is consumed atomically on first use, so a retry after success is refused.

Parameters

Section titled “Parameters”

Header Parameters

Section titled “Header Parameters”
x-edgekit-site-id
required

The site this request is for, within this tenant. Every official EdgeKit SDK sets it from the client you configured; set it yourself only when calling this API directly.

string
>= 1 characters <= 128 characters

Example 

site_example

The site this request is for, within this tenant. Every official EdgeKit SDK sets it from the client you configured; set it yourself only when calling this API directly.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
token
required
string
>= 1 characters <= 512 characters

Example 

q1w2e3r4
callbackURL
string
>= 1 characters <= 2048 characters

Example 

/account

Responses

Section titled “Responses”

200

Section titled “200”

The user is signed in on this device.

Media typeapplication/json
object
user
required
object
id
required
string format: uuid
email
required
string
emailVerified
required
boolean
name
required
string | null
firstName
required
string | null
lastName
required
string | null
image
required
string | null
session
required
object
id
required
string format: uuid
kind
required
string
Allowed values: edgekit
expiresAt
required
string format: date-time

Example 

{
  "user": {
    "id": "01926f3a-8b4c-7d2e-9f10-2a3b4c5d6e7f",
    "email": "user@example.com",
    "emailVerified": true,
    "name": "Ada Lovelace",
    "firstName": "Ada",
    "lastName": "Lovelace",
    "image": null
  },
  "session": {
    "id": "01926f3a-8b4d-7a11-8c22-3d4e5f6a7b8c",
    "kind": "edgekit",
    "expiresAt": "2026-08-30T09:00:00.000Z"
  }
}

400

Section titled “400”

Invalid request.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

403

Section titled “403”

Not allowed.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

404

Section titled “404”

Resource not found.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

422

Section titled “422”

Request validation failed.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

500

Section titled “500”

Unexpected error.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}