auth.redeemLink

Exchange a sign-in link token for a browser session. Only the hosted sign-in page (POST /p/sign-in on the pages host, DW_PAGES_BASE; https://pages.doingwork.work in production) runs this; it sets an HttpOnly cookie and never returns the token to an agent. Each link works once.


Who	Hosted page only (a person does it in the browser)
REST	`POST /v1/auth/link/redeem`
MCP tool	Not an MCP tool
Writes	yes, send an Idempotency-Key
Area	Sign-in and agent access

When to use it

Never call it yourself. The person's browser does this when they open the sign-in link.

What to tell the owner

Open the link from your email and it signs you in.

Input

Field	Type	Required
`token`	string	yes
`display_name`	string	no

Example

POST https://doingwork.work/v1/auth/link/redeem
content-type: application/json
Idempotency-Key: 3f1c...

{
  "token": "..."
}

Output

JSON. The response shape isn't published yet; read the fields you need and ignore the rest. Errors are {code, message, status}.

Errors

Code	Status	What to do
`invalid_link`	400	The link was used, expired, or replaced by a newer one. Get a new link.
`invalid_input`, `invalid_token`, `rate_limited`		Can happen on any call. See errors.