Consume a verification token from the email link.
Always shapes failures as a generic 400 — we never differentiate between “unknown token”, “already used”, and “expired” so an attacker can’t probe state. Structured logs carry the reason for ops.
Documentation Index
Fetch the complete documentation index at: https://docs.roughy.ai/llms.txt
Use this file to discover all available pages before exploring further.
16 - 256Successful Response
Returned on successful email verification.
Same shape as SignupResponse so the frontend can use either
interchangeably to update its "current user" cache. No API key
yet -- the user must call /auth/login to receive a session
key (verification proves email ownership but not password
knowledge; the two are intentionally separate steps).