Magic Link Exchange

POST

/auth/magic-link

POST

/auth/magic-link

curl -X POST https://https//https/auth/magic-link \
     -H "Content-Type: multipart/form-data" \
     -F lt="string" \
     -F device_name="string"

{
  "data": {
    "id": "03d358b6-857d-43a1-b065-f1c7d36238e9",
    "type": "auth_sessions",
    "attributes": {
      "created_at": "2026-05-13T14:24:03.136164Z",
      "token_type": "Bearer",
      "device_name": "web",
      "access_token": "939|pWr3WnQcsnxnFeaRkeHrwAGbXMYXT0lL3KEXaiSX6beea0ba"
    },
    "relationships": {
      "user": {
        "data": {
          "id": "03d358b6-857d-43a1-b065-f1c7d36238e9",
          "type": "users"
        }
      }
    }
  },
  "included": [
    {
      "id": "03d358b6-857d-43a1-b065-f1c7d36238e9",
      "type": "users",
      "attributes": {
        "email": "hitesht+1@sociosquares.com",
        "created_at": "2026-01-22T05:36:13.000000Z",
        "first_name": "Ross",
        "updated_at": "2026-05-13T14:15:23.000000Z"
      }
    }
  ]
}

Request

This endpoint expects a multipart form.

ltstringRequired

Required: The single-use signed magic-link token extracted from the lt query param on a CTA URL (e.g. https://app.itspropel.com/cta?…&lt=eyJ…). Single-use, 15-min TTL from email send. Any failure mode (expired, tampered, replayed, user-gone) returns the same generic 422 — do not try to distinguish.

Required: The single-use signed magic-link token extracted from the `lt` query param on a CTA URL (e.g. https://app.itspropel.com/cta?...&lt=eyJ...). Single-use, 15-min TTL from email send. Any failure mode (expired, tampered, replayed, user-gone) returns the same generic 422 — do not try to distinguish.

device_namestringRequired

Optional: Label for the issued Sanctum token (shows in /auth/session device list). Defaults to “magic-link” if omitted.

Response

dataobject

includedlist of objects

Errors

422

Unprocessable Entity Error