Verify the email code and issue tokens

curl --request POST \
  --url https://mcp.echozero.app/api/auth/verify \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "alice@example.com",
  "code": "123456",
  "recaptcha": "recaptcha_token_here"
}
'

{
  "success": true,
  "data": {
    "status": "success",
    "newUser": true,
    "onBoardingCompleted": true,
    "mfaRequired": true,
    "user": {
      "id": "507f1f77bcf86cd799439011",
      "username": "alice_bob",
      "email": "alice@example.com",
      "languageCode": "EN",
      "emailVerifiedAt": "2023-11-07T05:31:56Z"
    },
    "tokens": {
      "accessToken": "<string>",
      "refreshToken": "<string>",
      "mfaAccessToken": "<string>"
    },
    "errorMessage": "<string>",
    "unlocksAt": "2023-11-07T05:31:56Z"
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

POST

api

auth

verify

curl --request POST \
  --url https://mcp.echozero.app/api/auth/verify \
  --header 'Content-Type: application/json' \
  --data '
{
  "email": "alice@example.com",
  "code": "123456",
  "recaptcha": "recaptcha_token_here"
}
'

{
  "success": true,
  "data": {
    "status": "success",
    "newUser": true,
    "onBoardingCompleted": true,
    "mfaRequired": true,
    "user": {
      "id": "507f1f77bcf86cd799439011",
      "username": "alice_bob",
      "email": "alice@example.com",
      "languageCode": "EN",
      "emailVerifiedAt": "2023-11-07T05:31:56Z"
    },
    "tokens": {
      "accessToken": "<string>",
      "refreshToken": "<string>",
      "mfaAccessToken": "<string>"
    },
    "errorMessage": "<string>",
    "unlocksAt": "2023-11-07T05:31:56Z"
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

Headers

x-signature

string

HMAC-SHA256 signature: HMAC-SHA256(secretKey, timestamp + METHOD + path + body). Required for API-key authenticated requests (JWT/OAuth session auth is exempt).

x-timestamp

string

Request timestamp in epoch milliseconds. Required with x-signature for API-key auth. Rejected if drift exceeds 5 minutes.

Body

application/json

OpenAPI schema McpVerifyAuthLookupBodyDto. Mirrors GraphQL VerifyAuthLookupInput.

string

required

Same email as in /auth/lookup (required for both login and signup verification).

Example:

"alice@example.com"

code

string

required

Numeric verification code emailed to the user.

Example:

"123456"

recaptcha

string

required

reCAPTCHA token. Verification is skipped automatically in non-production environments.

Example:

"recaptcha_token_here"

Response

Verification succeeded. Tokens issued unless MFA is required.

success

boolean

required

Example:

true

data

object

required

Endpoint-specific payload

Show child attributes

Health

Auth

API Keys

User

Developer

Developer dashboard

Developer signal corpus

Trade Signals

Developer Agents (Marketplace)

Inbound Agent Signals

Trade

Token

Strategy

Agent

AI

Wallet

Notification

OAuth

Statics

Earn

Activity

Feed

Misc

Sandbox

MCP Protocol

Verify the email code and issue tokens

Headers

Body

Response