Email Verification Endpoints

Base URL: https://auth.calimatic.com/api/v1/auth/headless

Email verification endpoints use App Client authentication. Both endpoints are designed with anti-enumeration security: they always return 200 regardless of whether the email exists.

Authentication

All endpoints in this group use App Client authentication:

Endpoints Overview

POST /api/v1/auth/headless/email/verify-send

Send an email verification link to the user. Use this after signup or when the user requests a new verification link.

Anti-enumeration: Always returns 200 even if the email does not exist or is already verified.

Authentication: App Client (x-client-id + x-client-secret)

Request Body

Response (200 OK)

Always returns an empty body. No information is disclosed about whether the email exists.

{}

Error Codes

SDK Method

await client.email.sendVerification({ email: 'user@example.com' });

curl Example

curl -X POST https://auth.calimatic.com/api/v1/auth/headless/email/verify-send \
  -H "Content-Type: application/json" \
  -H "x-client-id: cca_aBcDeFgHiJkL" \
  -H "x-client-secret: ccas_xYzAbCdEfGhI" \
  -d '{
    "email": "user@example.com"
  }'

POST /api/v1/auth/headless/email/verify-confirm

Confirm email verification using a token from the verification email. The token is typically embedded in a link sent to the user's email (e.g., ?token=...). On success, the user's email address is marked as verified.

Authentication: App Client (x-client-id + x-client-secret)

Request Body

Response (200 OK)

Returns an empty body on success. The user's email is now verified.

{}

Error Codes

SDK Method

await client.email.confirmVerification({ token: verificationTokenFromEmail });

curl Example

curl -X POST https://auth.calimatic.com/api/v1/auth/headless/email/verify-confirm \
  -H "Content-Type: application/json" \
  -H "x-client-id: cca_aBcDeFgHiJkL" \
  -H "x-client-secret: ccas_xYzAbCdEfGhI" \
  -d '{
    "token": "vt_eyJhbGciOiJIUzI1NiJ9..."
  }'