API reference / Partner auth

post/v2/auth/verify

Exchange a sign-in token for a session

Operation
verifyMagicLink
Authentication
None — public

Sets an `HttpOnly`, `SameSite=Lax` session cookie. The cookie is the credential from here on — no token is returned in the body, so it cannot be lifted by a script.

Tokens are single-use and expire after fifteen minutes. Redemption is claimed with a conditional update, so two concurrent uses of one link cannot both succeed.

Request

Body

tokenstringrequired

Responses

200Signed in. The session is in the cookie, not the body.
userobjectrequired
tenant_idstringrequired
400The request body or query failed validation.
errorobjectrequired
401Invalid, expired, or already-used token. The message distinguishes which.
errorobjectrequired

Example

curl
curl -X POST https://api.haavisa.com/v2/auth/verify \
  -H "Content-Type: application/json" \
  -d '{
    "token": "<token>"
  }'

More in Partner auth

Something unclear? The eligibility guide explains the model behind the answers; the errors guide covers the envelope.