Verify Reset Code

Checks the 6-digit code from the password reset email (or the token from its link) and returns the reset token that Reset Password needs. It does not verify a new account's email.

POST/v1/auth/verify-email

Authentication

Public key?key=pk_…

Public key in the `key` query parameter. No OAuth, no secret.

Edge cache: no-store

Query Parameters

keystring

required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

emailstring

optional

The email the reset was requested for. Send it with `code`.

codestring

optional

The 6-digit code from the email. Send it with `email`.

tokenstring

optional

Alternative to `email` and `code`: the 32-character token from the email link.

Responses

200Success

application/json

titlestring

hideToastboolean

typestring

variantstring

messagestring

tokenstring

Errors

400`Invalid Verification Code`: wrong, expired or already used code or token, or a body with neither `token` nor `email` plus `code`.

401Missing or invalid public key.

429Too many attempts. Wait for the `Retry-After` header (900 seconds).

403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Notes

A code works once, for 15 minutes, and each account gets 5 guesses per hour. After that only the email link works.
Pass the returned `token` to Reset Password.
Limit: 10 requests per 15 minutes per visitor IP and site, shared with Request Password Reset.

Request

curl --request POST \
  --url "https://api.pandaidx.com/v1/auth/verify-email?key={{public_key}}" \
  --header "Content-Type: application/json" \
  --data '{"email":"alex.example@example.com","code":"123456"}'

Response200 OK

{
  "title": "Email verified successfully",
  "hideToast": false,
  "type": "success",
  "variant": "default",
  "message": "Email verified successfully",
  "token": "0123456789abcdef0123456789abcdef"
}