---
title: "Verify agent signup and create OAuth tokens"
method: POST
path: "/agent/signup/verify"
tags: ["Agent"]
---

# Verify agent signup and create OAuth tokens

`POST /agent/signup/verify`

Verifies the email code for an agent signup session and creates
the account when needed. When the session was started with a
`signup_code`, the reserved code is redeemed; sessions started
without a code skip the redemption step. An org-scoped OAuth
session for CLI authentication is minted and the raw tokens are
returned exactly once. For existing users, the optional `org_id`
selects which accessible workspace should receive the new
session (no signup-code redemption is performed for existing
users regardless of how the session was started).

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `signup_token` string, required
  - `verification_code` string, required
  - `org_id` string, uuid — Optional workspace id to target when the verified email already belongs to multiple workspaces

## Response `200`

Agent signup verified and OAuth tokens created

- object
  - `success` true, required
  - `data` object, required
    - `api_key` string, required — Legacy alias for access_token. New CLI builds should persist access_token and refresh_token.
    - `key_id` string, uuid, required — Legacy alias for oauth_grant_id
    - `key_prefix` string, required — Legacy display prefix derived from access_token
    - `access_token` string, required — OAuth access token for CLI API authentication
    - `refresh_token` string, required — OAuth refresh token used by the CLI to renew access
    - `token_type` 'Bearer', required
    - `expires_in` integer, required — Seconds until access_token expires
    - `auth_method` 'oauth', required
    - `oauth_grant_id` string, uuid, required
    - `oauth_client_id` string, required
    - `org_id` string, uuid, required
    - `org_name` string, nullable, required
    - `orgs` object[], required — Workspaces available to the verified email. The minted session targets `org_id`.
      - `id` string, uuid, required
      - `name` string, nullable, required

## Other responses

- `400` — Invalid request parameters
- `403` — Authenticated caller lacks permission for the operation
- `409` — The request conflicts with the current state of the resource
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/primitive/apis/primitive-api.md) · [All operations](https://skmtc.net/primitive/apis/primitive-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/primitive/primitive-api/versions/c2299d28022c/schema)