POST
Confirm registration
Send the email, the code from the email, and the password. This confirms the account, but you don’t get tokens yet: a brand-new user always has to set up security first, so the response is a SECURITY_SETUP_REQUIRED challenge. Take the session_token from the response into security setup to register a passkey or 2FA and get tokens. Didn’t get the code? Resend it.

Headers

x-program-id
string
required

Identifies the program. Can also be sent as the programId query parameter.

Body

application/json
email
string<email>
required
code
string
required

6-digit confirmation code from the email.

password
string
required

The password the user registered with.

Response

Account confirmed; security setup required before tokens are issued

success
boolean
Example:

true

data
object

Returned after confirming a new sign-up. The account is confirmed but no tokens are issued yet — the user must complete security setup (a passkey or 2FA) first. Take the session_token into the security setup flow.