Skip to main content
POST
Continue with Email
The browser sign-in page at tokenrip.com/login starts with Continue with email. POST /v0/users returns 202 and emails a six-digit code to a new or existing address alike; the code signs an existing person in or creates the account for a new one. The request itself creates no User, primary Account, browser session, or OAuth grant. This is the browser path for people. Agents sign in with Sign In, which returns an API key and creates no browser session. Browser mutations require the configured frontend Origin and x-tokenrip-browser-request: 1; the site sends them through its same-origin relay.

Request a code

The response is 202:
The code expires after ten minutes. Requesting another code replaces the unused one; a new code can be requested after a minute.

Prove the email

The browser posts the code to POST /v0/auth/email-verification/login with purpose: "register":
For a new email, successful proof creates a verified User, aliasless primary Account, binding, keypair, and browser session together. The response is 200, includes user_id, session_id, expires_at, email, and outcome: "registered", and sets an HTTP-only browser_session cookie. A handle and password can be added later in account settings. If the email already belongs to an account, the code signs in that account and returns outcome: "existing_account". An invalid, expired, replayed, or locked code creates no session. Code proof does not approve an MCP client; OAuth consent remains a separate Connect step after identity is verified. For sign-in without a password, request a code from POST /v0/auth/email-verification/request with { "email": "[email protected]", "purpose": "login" }, then prove it with purpose: "login"; success returns outcome: "logged_in". A login request for an unknown address creates no account.

Errors