POST /api/auth/verify-email — Verify Your Email OTP

POST /api/auth/verify-email — Submit the OTP sent to your email to verify your account. Returns accessToken and refreshToken on success.

After registering a new Flowmatic account, you receive a 6-digit one-time passcode (OTP) at the email address you provided. Use this endpoint to submit that OTP and complete your account verification. On success, Flowmatic returns a JWT accessToken and a refreshToken — you will need these for all subsequent authenticated API calls.

Store your accessToken and refreshToken securely. Never expose them in client-side code, public repositories, or browser URLs. Use environment variables or a secrets manager to keep them safe in your applications.

Endpoint

POST https://api.flowmatic.io/api/auth/verify-email

Request Body

email · string · required

The email address you used when registering your Flowmatic account. This must exactly match the address that the OTP was sent to.

otp · string · required

The 6-digit numeric verification code that was emailed to you after registration. OTP codes are time-sensitive — if yours has expired, use POST /api/auth/resend-otp to request a fresh one.

Example Request

Request

curl -X POST https://api.flowmatic.io/api/auth/verify-email \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[e-mail]",
    "otp": "482910"
  }'

Request Body

{
  "email": "[e-mail]",
  "otp": "482910"
}

Response

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJ1c3JfMDEyMzQ1IiwiZW1haWwiOiJhbGljZUBleGFtcGxlLmNvbSIsImlhdCI6MTcxNTAwMDAwMCwiZXhwIjoxNzE1MDAzNjAwfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJ1c3JfMDEyMzQ1IiwidHlwZSI6InJlZnJlc2giLCJpYXQiOjE3MTUwMDAwMDAsImV4cCI6MTcxNzU5MjAwMH0.4iGvRkH2Z9wXcLsAZomDyJ7LqPnKWtV3HqBl3tJkXyE"
}

Response Fields

accessToken · string

A signed JSON Web Token (JWT) that authenticates your API requests. Include this in the Authorization header of every subsequent request as Bearer <accessToken>. Access tokens are short-lived — when they expire, use the Refresh Token endpoint to obtain a new pair.

refreshToken · string

A long-lived token used exclusively to obtain a fresh accessToken and refreshToken pair once your current access token expires. Store this value securely alongside your accessToken. See POST /api/auth/refresh-token for usage details.

Next Steps

With your accessToken in hand, you are ready to make authenticated requests to the Flowmatic API. Pass it in the Authorization header on every request:

curl https://api.flowmatic.io/api/workflows \
  -H "Authorization: Bearer <your_accessToken>"

When your accessToken expires, exchange your refreshToken for a new pair by calling POST /api/auth/refresh-token.