Verify an email address with an emailed token (gesture-consumed).
const url = 'https://api.tradr.cloud/api/auth/verify-email';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"token":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.tradr.cloud/api/auth/verify-email \ --header 'Content-Type: application/json' \ --data '{ "token": "example" }'Public. Rate limited by client IP (10 / 15 min, the login posture; token guessing is primarily throttled by the token’s 256-bit entropy + 24 h TTL). Atomically consumes the single-use verification token and marks the account email-verified in one transaction. Expired, already-consumed, and unrecognized tokens are indistinguishable: one generic 400 INVALID_OR_EXPIRED_TOKEN (the frontend then offers the resend path). Consumption is THIS POST — fetching the emailed GET link never mutates, so prefetchers and link scanners burn nothing. Fully functional when the instance has no email configured (consuming an existing token sends nothing).
Request Bodyrequired
Section titled “Request Bodyrequired”object
The raw token from the emailed link’s URL fragment.
Examplegenerated
{ "token": "example"}Responses
Section titled “Responses”{ success: true } — account marked email-verified, token consumed.
Validation error
Rate limit reached (IP-keyed).