> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowmaticai.in/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /api/auth/verify-email — Verify Your Email OTP

> POST /api/auth/verify-email — Submit the OTP sent to your email to verify your account. Returns accessToken and refreshToken on success.

After registering a new Flowmatic account, you receive a 6-digit one-time passcode (OTP) at the email address you provided. Use this endpoint to submit that OTP and complete your account verification. On success, Flowmatic returns a JWT `accessToken` and a `refreshToken` — you will need these for all subsequent authenticated API calls.

<Tip>
  Store your `accessToken` and `refreshToken` securely. Never expose them in client-side code, public repositories, or browser URLs. Use environment variables or a secrets manager to keep them safe in your applications.
</Tip>

## Endpoint

```
POST https://api.flowmatic.io/api/auth/verify-email
```

## Request Body

<ParamField body="email" type="string" required>
  The email address you used when registering your Flowmatic account. This must exactly match the address that the OTP was sent to.
</ParamField>

<ParamField body="otp" type="string" required>
  The 6-digit numeric verification code that was emailed to you after registration. OTP codes are time-sensitive — if yours has expired, use [POST /api/auth/resend-otp](/api-reference/auth/resend-otp) to request a fresh one.
</ParamField>

## Example Request

<Tabs>
  <Tab title="Request">
    ```bash theme={null}
    curl -X POST https://api.flowmatic.io/api/auth/verify-email \
      -H "Content-Type: application/json" \
      -d '{
        "email": "alice@example.com",
        "otp": "482910"
      }'
    ```
  </Tab>

  <Tab title="Request Body">
    ```json theme={null}
    {
      "email": "alice@example.com",
      "otp": "482910"
    }
    ```
  </Tab>

  <Tab title="Response">
    ```json theme={null}
    {
      "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJ1c3JfMDEyMzQ1IiwiZW1haWwiOiJhbGljZUBleGFtcGxlLmNvbSIsImlhdCI6MTcxNTAwMDAwMCwiZXhwIjoxNzE1MDAzNjAwfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
      "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJ1c3JfMDEyMzQ1IiwidHlwZSI6InJlZnJlc2giLCJpYXQiOjE3MTUwMDAwMDAsImV4cCI6MTcxNzU5MjAwMH0.4iGvRkH2Z9wXcLsAZomDyJ7LqPnKWtV3HqBl3tJkXyE"
    }
    ```
  </Tab>
</Tabs>

## Response Fields

<ResponseField name="accessToken" type="string">
  A signed JSON Web Token (JWT) that authenticates your API requests. Include this in the `Authorization` header of every subsequent request as `Bearer <accessToken>`. Access tokens are short-lived — when they expire, use the [Refresh Token](/api-reference/auth/refresh-token) endpoint to obtain a new pair.
</ResponseField>

<ResponseField name="refreshToken" type="string">
  A long-lived token used exclusively to obtain a fresh `accessToken` and `refreshToken` pair once your current access token expires. Store this value securely alongside your `accessToken`. See [POST /api/auth/refresh-token](/api-reference/auth/refresh-token) for usage details.
</ResponseField>

## Next Steps

With your `accessToken` in hand, you are ready to make authenticated requests to the Flowmatic API. Pass it in the `Authorization` header on every request:

```bash theme={null}
curl https://api.flowmatic.io/api/workflows \
  -H "Authorization: Bearer <your_accessToken>"
```

When your `accessToken` expires, exchange your `refreshToken` for a new pair by calling [POST /api/auth/refresh-token](/api-reference/auth/refresh-token).