Complete a magic link authentication. If the email belongs to an existing account, signs the user in. Otherwise provisions a new Site Qwality account, Stytch organization, Stripe customer, default notification group, and welcome email. This is the same shape as `/signup` minus the password.
POST
/auth/magic-link/authenticate
const url = 'https://api.siteqwality.com/auth/magic-link/authenticate';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"token":"example","promotekit_referral":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.siteqwality.com/auth/magic-link/authenticate \ --header 'Content-Type: application/json' \ --data '{ "token": "example", "promotekit_referral": "example" }'Request Body required
Section titled “Request Body required ” Media type application/json
object
token
required
string
promotekit_referral
The PromoteKit referral, recorded on the Stripe customer when this click creates the account. Ignored when it signs an existing user in.
string | null
Example generated
{ "token": "example", "promotekit_referral": "example"}Responses
Section titled “ Responses ”Authenticated, or MFA required
Media type application/json
One of:
A session from a login, plus where the frontend should land.
object
session_token
required
string
session_jwt
required
string
member
required
Full member info returned on every authentication response.
object
name
string | null
email
required
string
organization_id
required
string
roles
required
Array<string>
is_new_account
True only when this authentication created a new account.
boolean
redirect_path
Sanitized at start; absent on the doors that never take one.
string | null
Answer of any login endpoint when the member has confirmed TOTP. The
frontend checks mfa_required before reading an AuthResponse.
object
mfa_required
required
Always true; the discriminator against AuthResponse.
boolean
pending_token
required
sqm1_..., valid 10 minutes for 5 attempts.
string
methods
required
Array<string>
redirect_path
string | null
Example
{ "methods": [ "totp" ]}Invalid or expired magic link
Internal server error