Verify

:::note This feature is disabled by default for new tenants as of 8 June 2017. Please see Application Grant Types for more information. :::

Once you have a verification code, use this endpoint to login the user with their phone number/email and verification code. This is active authentication, so the user must enter the code in your app.

Remarks

• The profile scope value requests access to the End-User’s default profile Claims, which are: name, family_name, given_name, middle_name, nickname, preferred_username, profile, picture, website, gender, birthdate, zoneinfo, locale, and updated_at.
• The email scope value requests access to the email and email_verified Claims.
• The sample auth0.js script uses the library version 8. If you are using auth0.js version 7, please see this reference guide.

Learn More

• Passwordless Best Practices

POST https://{yourDomain}/passwordless/verify

Verify

cURL

curl --request POST \
  --url https://{yourDomain}/passwordless/verify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "grant_type": "password",
  "client_id": "${account.clientId}",
  "connection": "email",
  "username": "USER_EMAIL_OR_PHONE",
  "password": "VERIFICATION_CODE",
  "redirect_uri": "https://yourapp.com/callback",
  "scope": "openid profile"
}
'

Authorizations

Authorization · string · header · required

Access token obtained from the authentication flow

Body

application/json

grant_type · string · required

Grant type, must be password.

Example:

"password"

client_id · string · required

The client_id of your application.

Example:

"${account.clientId}"

connection · enum<string> · required

Use sms or email (should be the same as POST /passwordless/start).

Available options: email, sms

Example:

"email"

username · string · required

The user's phone number if connection=sms, or the user's email if connection=email.

Example:

"USER_EMAIL_OR_PHONE"

password · string · required

The user's verification code.

Example:

"VERIFICATION_CODE"

redirect_uri · string · required

Callback URL registered with your application's Allowed Callback URLs.

Example:

"https://yourapp.com/callback"

scope · string

Use openid to get an ID Token, or openid profile email to include user profile information in the ID Token.

Example:

"openid profile"

Response

200

User authenticated successfully.