Email a one-time sign-in link

POST/api/auth/login/magic-link/request

requestMagicLink

Anonymous. Always returns `202 Accepted` with `{ ok: true }`, before any account lookup, so neither the body, the status nor the latency says whether an account uses the address. A link is mailed only when a live human account holds the address verified; it expires in 15 minutes and works once. Never creates an account. Rate limited per normalised address and per source IP, both silently: an exhausted bucket still gets the same 202 and mails nothing.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/login/magic-link/request' \
  -H 'Content-Type: application/json' \
  -d '{"email":"alice@example.com"}'

fetch

fetch("https://neosource.dev/api/auth/login/magic-link/request", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"email":"alice@example.com"}),
});

Request bodyrequired

application/json

MagicLinkRequest

object

Request body for `POST /api/auth/login/magic-link/request`. Every call gets the same `202 { ok: true }`, whatever the address.

emailrequired: string
example"alice@example.com"
next: string | null
Same-origin path to land on after signing in, carried in the mailed link. Dropped unless it is a plain path (`/…`, not `//…`, printable ASCII, at most 512 bytes).
example"/invites/nsi_example"

additional propertiesnot allowed

Responses

202Link mailed if applicable (always — enumeration-safe)

application/json

MagicLinkRequestResponse

object

okrequired: boolean

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget