Skip to main content
POST
auth.signin.verify

Authorizations

Authorization
string
header
required

A Lath API key: lath_live_… or lath_test_… on a server, lath_live_pk… or lath_test_pk… in a browser.

Headers

Idempotency-Key
string

Replays the stored response for the same key and input; refuses different input.

Body

application/json
challengeId
string<uuid>
required
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
secret
string
required

The 6-digit code, or the token from the link

Required string length: 6 - 64
userAgent
string
Maximum string length: 400
handoff
boolean

true to receive a redirect with a one-time code instead of the tokens. The sign-in must have been started with a redirectTo.

Response

{ activityId, result }. activityId is empty for reads.

activityId
string
required

The activity this call created, or empty for a read.

result
object
required
Last modified on September 23, 2026