Resend the email confirmation link
Full sessions only. No-ops with a 200 if the account is already verified, or if a still-usable link was sent within the last minute (throttled so this can't be used to mail-bomb an inbox).
View as MarkdownAuthorization
bearer In: header
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/v1/me/verify-email/resend"{ "message": "string"}Set or change password
Full sessions only. current_password is required only when the account already has one; a magic-link account may set its first password only within 10 minutes of signing in (else 403 reauth_required). Wrong current password returns 403, not 401. A change ends every other session: all refresh tokens except keep_refresh_token are revoked and access tokens already minted stop working (identity epoch), so the caller refreshes on the session it kept.
Record where the caller's account came from
Full sessions only. The login app posts the first-touch sign-up source once, right after a new account's first session. The first post within a day of the account's creation is kept; later posts and posts for older accounts are ignored. Values that aren't plain campaign tags, known tool names, a hostname or a path are dropped: a referrer is cut to its host and a landing page to the first two segments of its path, so nothing that identifies a person and no capability link is stored. The body is limited to 4 KB.