Portal
Verify Magic Link (POST)
Exchange a magic link token sent in the request body for a portal session
POST
/
portal
/
auth
/
verify
Verify a magic link (token in body) and start a session
curl --request POST \
--url https://billing.example.com/portal/auth/verify \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"token": "<string>"
}
'import requests
url = "https://billing.example.com/portal/auth/verify"
payload = { "token": "<string>" }
headers = {
"Authorization": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({token: '<string>'})
};
fetch('https://billing.example.com/portal/auth/verify', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://billing.example.com/portal/auth/verify",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'token' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://billing.example.com/portal/auth/verify"
payload := strings.NewReader("{\n \"token\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://billing.example.com/portal/auth/verify")
.header("Authorization", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"token\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://billing.example.com/portal/auth/verify")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"token\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"message": "<string>"
}{
"error": {
"code": "validation_failed",
"message": "<string>"
}
}{
"error": {
"code": "validation_failed",
"message": "<string>"
}
}This is the preferred form of magic-link verification. The token travels in the
JSON body rather than the query string, so it is not written to Referer headers,
browser history, or access logs. The GET form is kept for links opened directly
from email clients.
Request Body
| Field | Type | Description |
|---|---|---|
token | string | The magic link token from the email (required) |
Example Request
curl -X POST "https://api.recurso.dev/portal/auth/verify" \
-H "Content-Type: application/json" \
-d '{ "token": "mlk_a1b2c3d4e5f6g7h8i9j0" }'
Response
{
"message": "Logged in successfully"
}
portal_session cookie
(plus a readable portal_csrf double-submit cookie) — it is never in the JSON
body. Send subsequent portal requests with credentials: "include".
Magic link tokens are single-use and expire after 15 minutes. An invalid or
expired token returns
401 with the canonical error envelope.⌘I
Verify a magic link (token in body) and start a session
curl --request POST \
--url https://billing.example.com/portal/auth/verify \
--header 'Authorization: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"token": "<string>"
}
'import requests
url = "https://billing.example.com/portal/auth/verify"
payload = { "token": "<string>" }
headers = {
"Authorization": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({token: '<string>'})
};
fetch('https://billing.example.com/portal/auth/verify', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://billing.example.com/portal/auth/verify",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'token' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://billing.example.com/portal/auth/verify"
payload := strings.NewReader("{\n \"token\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://billing.example.com/portal/auth/verify")
.header("Authorization", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"token\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://billing.example.com/portal/auth/verify")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"token\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"message": "<string>"
}{
"error": {
"code": "validation_failed",
"message": "<string>"
}
}{
"error": {
"code": "validation_failed",
"message": "<string>"
}
}