Redeem a sign-in link
POST/admin/auth/magic-link/verify
The token from the e-mail becomes a session, and sets the same cookie sign-in does. Single use.
invalid_code collapses wrong, expired and already-redeemed into one
answer, on purpose — there is deliberately no code_expired. A client cannot
tell a guessed token from a spent one, which is the point.
The second factor is still enforced: an inbox alone does not reach the console when the account has TOTP on.
Request
Responses
- 200
- 400
- 401
- 403
- 429
Signed in — sets the sb_admin_session cookie
Malformed body, or token missing
invalid_code, or two_factor_required
account_suspended
too_many_requests — keyed on the caller's IP, never on the token