POST `/auth/login/email-code`

Passwordless login using email verification code, supports auto-registration

Authentication None application/json

Request Body

Schema: dto.LoginByEmailCodeRequest

Field	Type	Required
`code`	`string`	Yes
`email`	`string`	Yes
`captcha_token`	`string`	No
`register_if_new`	`boolean`	No
`tenant_id`	`string`	No

Status	Description	Schema
200	Login successful	`dto.LoginByCodeResponse`

Field	Type	Required	Description
`access_token`	`string`	No
`expires_in`	`integer`	No
`is_new_user`	`boolean`	No
`refresh_token`	`string`	No
`token_type`	`string`	No
`user`	`dto.UserInfo`	No
`user_id`	`string`	No	User ID (redundant with User.ID for flat access)

User basic information

Field	Type	Required	Example	Description
`created_at`	`string`	No	`2026-01-15T10:30:00Z`	Account creation time
`email`	`string`	No	`john@example.com`	Email
`id`	`string`	No	`usr_abc123`	User ID
`must_change_password`	`boolean`	No	`False`	Password must be changed
`password_expires_in`	`integer`	No	`30`	Days until password expires
`password_warning`	`string`	No	`expiring`	Password warning: expiring/expired_grace/expired
`phone`	`string`	No	`13800138000`	Phone
`status`	`string`	No	`active`	Status
`username`	`string`	No	`john.doe`	Username