Request a magic-link sign-in email

POST

/v1/auth/request

const url = 'https://beta-api.plune.ai/v1/auth/request';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"email":"[email protected]"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://beta-api.plune.ai/v1/auth/request \
  --header 'Content-Type: application/json' \
  --data '{ "email": "[email protected]" }'

Any well-formed email → uniform 202 (never reveals whether an account exists). When the deployment is invite-only (see door on /health), an address that is neither invited nor already registered gets the SAME 202 and no email — the answer must not become a way to ask whether an address is invited. The sign-in screen says the beta is invite-only before the request is made. An address whose account its person deleted (#952) gets the same 202 and, instead of a link, a letter in the account’s language saying until when it waits in the Bin and how to get it back; no new account is made on it meanwhile.

Request Body^required

application/json

object

email

required

string format: email

Example

{
  "email": "[email protected]"
}

Responses

202

Accepted — if the email is valid, a link was sent

400

Malformed email

application/json

object

error

required

string

Example ^generated

{
  "error": "example"
}

429

Rate-limited. Two independent throttles guard this route — one keyed by the email (how often one address may be asked for), one by the client IP (how many addresses one origin may walk through). error names the limit that was hit (per address or per IP) and the wait, e.g. too many sign-in requests: at most 5 a link per address in 15 minutes — try again in 7 minutes. Retry-After carries the seconds until the oldest counted request leaves the window.

Headers

Retry-After

integer

Seconds until the window rolls over