Skip to content
Orvanov0.2.0

account.createEmailCodeSession

POST
/v1/account/sessions/email-code
import { Client, Orvano } from '@orvano/js'


const orvano = new Orvano(new Client({ endpoint: 'https://orvano.example.com' }))


const authResult = await orvano.account.createEmailCodeSession({
  email: 'ada@example.com',
  code: '428613',
})
console.log(authResult)

Signs a user in with an emailed code. After 5 wrong tries the code stops working; ask for a new one.

Client SDKs: JavaScript in the browser, Next.js, and Flutter call it for the signed in user, or with no credential. A failure answers with a problem details body; its code has a page under Errors.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

A sign in with an emailed code.

object
email
required

The email the code was sent to; case does not matter.

string
code
required

The 6 digit code from the email.

string

Responses

Section titled “Responses”

201

Section titled “201”

The request has succeeded and a new resource has been created as a result.

Media typeapplication/json

A signed in user and their new session.

object
user
required

The user.

object
id
required

The user ID.

string
email
required
Any of:
string
emailVerified
required

Whether the email has been verified. Also the access token’s email_verified claim.

boolean
emailVerifiedAt
required
Any of:
string format: date-time
name
required
Any of:
string
status
required

Whether the user may sign in.

string
Allowed values: active blocked
metadata
required

Your own data about the user: a JSON object of at most 16 KB.

object
createdAt
required

When the user signed up.

string format: date-time
lastSignInAt
required
Any of:
string format: date-time
session
required

The new session’s tokens.

object
accessToken
required

An ES256 JWT, valid for 15 minutes.

string
accessTokenExpiresAt
required

When the access token expires.

string format: date-time
refreshToken
required

Trades itself for a new pair once; keep it secret.

string
refreshTokenExpiresAt
required

When the session ends unless it refreshes first: 30 days idle, or 365 days after sign in.

string format: date-time
sessionId
required

The session ID, also the sid claim of the access token.

string
isNewUser
required

Whether this call created the user: true from sign up, and from a magic link or email code for a new email.

boolean
verificationEmail
required
Any of:

What happened to the verification email of a sign up. The user and session are created whatever it says.

string
Allowed values: queued not_configured rate_limited
Example
{
  "user": {
    "id": "01924f5e-8d2b-7c4d-8e21-3d5e6f7a8b9c",
    "email": "ada@example.com",
    "emailVerified": false,
    "name": "Ada Lovelace",
    "status": "active"
  },
  "session": {
    "accessToken": "eyJhbGciOiJFUzI1NiIsImtpZCI6Ii4uLiJ9.e30.c2ln",
    "refreshToken": "orv_rt_AZJPXo0rfE2OIT1ebzqLnA.Zm9vYmFyZm9vYmFyZm9vYmFyZm9vYmFyZm9vYmFyZm9v",
    "sessionId": "01924f5e-9a1b-7c4d-8e21-3d5e6f7a8b9c"
  },
  "isNewUser": false,
  "verificationEmail": "queued"
}

default

Section titled “default”

An unexpected error response.

Media typeapplication/problem+json

An RFC 9457 problem details body. Every operation declares it as its default response, sent as application/problem+json.

object
type
required

Identifies the error: https://orvano.dev/errors/<code>.

string
title
required

The standard HTTP reason phrase for the status.

string
status
required

The HTTP status code.

integer format: int32
detail

A short, safe sentence about this occurrence, when the server has one.

string
code
required

Orvano’s stable error code, from the ErrorCode catalog. SDKs treat it as a plain string.

string
requestId
required

The request ID to quote when reporting a problem; also sent as X-Request-Id.

string
Example
{
  "type": "https://orvano.dev/errors/not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "requestId": "4bf92f3577b34da6a3ce929d0e0e4736"
}