---
title: "Authenticate by verifying the possession of a one-time token. Usually for use as clickable links."
method: GET
path: "/verify"
tags: ["auth"]
---

# Authenticate by verifying the possession of a one-time token. Usually for use as clickable links.

`GET /verify`

## Query parameters

- `token` string, required
- `type` 'signup' | 'invite' | 'recovery' | 'magiclink' | 'email_change', required
- `redirect_to` string, uri

## Other responses

- `302` — HTTP See Other redirect response where `Location` is a specially formatted URL that includes an `access_token`, `refresh_token`, `expires_in` as URL query encoded values in the URL fragment (anything after `#`). These values are encoded in the fragment as this value is only visible to the browser handling the redirect and is not sent to the server.

---

[API](https://skmtc.net/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.net/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/versions/2664b89bee49/schema)