Signing in

No password needed

You sign in with a short one-time code sent to your email address.

1. 1Enter your email

We’ll check the address format and send a sign-in code.

1. 1Get the 6-digit code

Check your inbox. The code usually arrives within a few seconds.

1. 1Verify and continue

Enter the code to sign in. You’ll be taken back to where you were.

POST /auth/magic-code-request

Requests a 6-digit OTP code for the given email address. Auto-provisions the user if they do not exist.

Request Payload:

{
  "email": "you@example.com"
}

POST /auth/magic-code-verify

Validates the 6-digit OTP passcode. On success, issues authentication tokens.

Request Payload:

{
  "email": "you@example.com",
  "code": "123456"
}

Issued HTTP-Only Cookies:

• access_token: JWT access payload (expires 15m).
• refresh_token: JWT renewal payload (expires 7d).

Security Standards

Cookies are secured with httpOnly: true, preventing reading via client scripting (XSS protection). Production deployments use domain scoping (.seiso.world) and enforce HTTPS transmission.