EmailOtp.Client.verifyCode

Exchanges a code request ID and emailed code for an attestation: a signed bearer token confirming inbox access for one API origin. The issuer is the identity service that sent the code.

Usage

import * as EmailOtp from 'mppx/extensions/identity/email-otp'
 
declare const code: string
declare const id: string
 
const { attestation, expiresAt } = await EmailOtp.Client.verifyCode({
  code: code.trim(),
  id,
  issuer: 'https://identity.mpp.tempo.xyz',
})

Use the same issuer and the id from sendCode. Supply the token to prover through attestations, or send it in Identity-Attestation only to its intended API origin over HTTPS. Treat it like a session token.

Return type

Promise<{ attestation: string; expiresAt: Date }> from the issuer's attestation and expires_at fields. The helper validates a nonempty token string and parseable expiry, not the token signature. The API's EmailOtp.Server.verifier authenticates it. The issuer controls the lifetime.

Parameters

code

• Type: string

Emailed code. This low-level helper doesn't trim it or retry; normalize user input yourself.

fetch (optional)

• Type: typeof globalThis.fetch
• Default: globalThis.fetch

Fetch for the issuer. The call bypasses automatic payment handling in Machine Payments Protocol (MPP) fetch wrappers, so it never pays an issuer's 402 payment request.

id

• Type: string

Code request ID from sendCode.

issuer

• Type: string

Trusted issuer. Requires HTTPS, except HTTP on localhost or 127.0.0.1. Trailing slashes are removed before appending /email/verify. This helper has no issuer allowlist.

Errors

Throws EmailOtp.Client.EmailOtpError for an insecure issuer, non-success response (including a rejected code), or malformed attestation response. Network errors propagate. Calls use JSON POST and don't follow redirects. Unlike prover, this helper doesn't prompt again after 400.