Name the account a sign-in link signs into, without spending it

POST/api/auth/login/magic-link/inspect

inspectMagicLink

Anonymous and idempotent: the token is NOT consumed. Returns 200 with the handle of the account `/api/auth/login/magic-link/confirm` would sign in, so the landing page can say "Sign in as @handle" before anything happens — a link someone mailed to their own account and handed to you names their account, not yours. Returns 410 with `{ error: "invalid_or_expired" }` for every token confirm would refuse (missing, spent, expired, wrong-purpose, or an account that no longer holds the address verified or holds no password, TOTP or passkey). Rate limited per source IP.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/login/magic-link/inspect' \
  -H 'Content-Type: application/json' \
  -d '{"token":"string"}'

fetch

fetch("https://neosource.dev/api/auth/login/magic-link/inspect", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"token":"string"}),
});

Request bodyrequired

application/json

MagicLinkInspectRequest

object

Request body for `POST /api/auth/login/magic-link/inspect`: which account would this link sign into? Spends nothing.

tokenrequired: string
Base64url-encoded raw token from the sign-in link.

additional propertiesnot allowed

Responses

200The link is live and signs into this account

application/json

MagicLinkInspectResponse

object

The account a live sign-in link signs into, shown on the landing page before the "Sign in" button (ADR 0182, login CSRF).

handlerequired: string

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
410Gone — one of: invalid_or_expired
429Rate limited — retry after the interval in the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget