---
title: auth.redeemLink | Doing Work API
description: Exchange a sign-in link token for a browser session. Only the hosted sign-in page (POST /p/sign-in on the pages host, DW_PAGES_BASE; https://pages.doingwor
url: https://doingwork.work/docs/reference/auth-redeemlink/
---

# auth.redeemLink

Exchange a sign-in link token for a browser session. Only the hosted sign-in page (POST /p/sign-in on the pages host, DW_PAGES_BASE; https://pages.doingwork.work in production) runs this; it sets an HttpOnly cookie and never returns the token to an agent. Each link works once.

|  |  |
|---|---|
| Who | Hosted page only (a person does it in the browser) |
| REST | `POST /v1/auth/link/redeem` |
| MCP tool | Not an MCP tool |
| Writes | yes, send an Idempotency-Key |
| Area | [Sign-in and agent access](https://doingwork.work/docs/reference/#sign-in-and-agent-access) |

## When to use it

Never call it yourself. The person's browser does this when they open the sign-in link.

## What to tell the owner

Open the link from your email and it signs you in.

## Input

| Field | Type | Required |
|---|---|---|
| `token` | string | yes |
| `display_name` | string | no |

## Example

```http
POST https://doingwork.work/v1/auth/link/redeem
content-type: application/json
Idempotency-Key: 3f1c...

{
  "token": "..."
}
```

## Output

JSON. The response shape isn't published yet; read the fields you need and ignore the rest. Errors are `{code, message, status}`.

## Errors

| Code | Status | What to do |
|---|---|---|
| `invalid_link` | 400 | The link was used, expired, or replaced by a newer one. Get a new link. |
| `invalid_input`, `invalid_token`, `rate_limited` |  | Can happen on any call. See [errors](https://doingwork.work/docs/errors/). |