Confirm an email-verification token

POST/api/auth/email/confirm

confirmEmail

Single-use consume of an `email_verify` token (24h TTL). On success, flips `accounts.email_verified_at = now()`. Any failure mode (missing / consumed / expired / email-changed) collapses to a generic 410 with `{ error: "invalid_or_expired" }` so the response shape doesn't leak whether the token ever existed.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/email/confirm' \
  -H 'Content-Type: application/json' \
  -d '{"token":"string"}'

fetch

fetch("https://neosource.dev/api/auth/email/confirm", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"token":"string"}),
});

Request bodyrequired

application/json

ConfirmEmailRequest

object

tokenrequired: string
Base64url-encoded raw token from the verification link.

additional propertiesnot allowed

Responses

200Email verified

application/json

ConfirmEmailResponse

object

okrequired: boolean

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
410Gone — one of: invalid_or_expired
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget