Skip to main content
POST
Finalize login

Headers

X-Refresh-Token
string

Optional refresh token from a previous session. When provided, the session associated with this token is revoked once the new session is established, so a re-login does not leave the old session dangling. Ignored when the token is missing or can no longer be resolved to an active session.

Body

application/json
challenge_token
string
required

The challenge token obtained from a login method.

Example:

"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9..."

code_verifier
string

PKCE code verifier matching the code_challenge originally sent on the login flow (OAuth, standalone OTP, or migration). Required when the challenge token carries a pkce_challenge claim; ignored otherwise.

Example:

"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

Response

OK

access_token
string
required
Example:

"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9..."

expires_at
integer<int64>
required

Unix timestamp of when the access token expires.

Example:

1717689600