# loginByEmailVerification

Login By Email Verification - exchanges the 6-digit code emailed by sendLoginCodeEmail for a bearer token.

Last updated October 2, 2026

## Reference

Authentication: **not required**

```
Login By Email Verification - exchanges the 6-digit code emailed by sendLoginCodeEmail for a bearer token.

Authentication: Not required

Parameters:
- email (string, required): The address the code was sent to: the account's
  primary email or one of its linked emails
- code (string, required): The 6-digit code from the email
- authenticationMethod (string, required): EMAIL_CODE

Behavior:
- Succeeds only if the code matches and has not expired
- Each code accepts at most 5 attempts, including the successful one. After that it is locked and a new code must be requested
- A code can be used once
- An unknown email and a wrong, used, or locked code all return "invalid code"
- Requests are rate limited per client IP and per email
- Issues an opaque bearer token on success. Send it as 'Authorization: Bearer <token>' on methods that require authentication

Returns:
- { token: string, userId: string }

Example:
{
  "method": "loginByEmailVerification",
  "params": {
    "email": "YOUR_EMAIL_ADDRESS",
    "code": "123456",
    "authenticationMethod": "EMAIL_CODE"
  }
}
```

## loginByEmailVerification request

POST https://api-v2.financesavi.com/rpc · Public

### cURL

```bash
curl -sS --max-time 30 -X POST 'https://api-v2.financesavi.com/rpc' \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"loginByEmailVerification","params":{"email":"YOUR_EMAIL_ADDRESS","code":"123456","authenticationMethod":"EMAIL_CODE"},"id":1}'
```

### JavaScript

```javascript
const response = await fetch("https://api-v2.financesavi.com/rpc", {
  method: 'POST',
  signal: AbortSignal.timeout(30_000),
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "jsonrpc": "2.0",
      "method": "loginByEmailVerification",
      "params": {
        "email": "YOUR_EMAIL_ADDRESS",
        "code": "123456",
        "authenticationMethod": "EMAIL_CODE"
      },
      "id": 1
    }),
});
console.log(await response.json());
```

### TypeScript

```typescript
const response = await fetch("https://api-v2.financesavi.com/rpc", {
  method: 'POST',
  signal: AbortSignal.timeout(30_000),
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "jsonrpc": "2.0",
      "method": "loginByEmailVerification",
      "params": {
        "email": "YOUR_EMAIL_ADDRESS",
        "code": "123456",
        "authenticationMethod": "EMAIL_CODE"
      },
      "id": 1
    }),
});
console.log(await response.json());
```

### Python

```python
import os
import requests

response = requests.post(
    "https://api-v2.financesavi.com/rpc",
    json={
        "jsonrpc": "2.0",
        "method": "loginByEmailVerification",
        "params": {
            "email": "YOUR_EMAIL_ADDRESS",
            "code": "123456",
            "authenticationMethod": "EMAIL_CODE",
        },
        "id": 1,
    },
    timeout=30,
)
print(response.json())
```

### Go

```go
package main

import (
  "fmt"
  "io"
  "net/http"
  "strings"
  "time"
)

func main() {
  payload := strings.NewReader("{\"jsonrpc\":\"2.0\",\"method\":\"loginByEmailVerification\",\"params\":{\"email\":\"YOUR_EMAIL_ADDRESS\",\"code\":\"123456\",\"authenticationMethod\":\"EMAIL_CODE\"},\"id\":1}")
  req, err := http.NewRequest("POST", "https://api-v2.financesavi.com/rpc", payload)
  if err != nil { panic(err) }
  req.Header.Set("Content-Type", "application/json")
  client := &http.Client{Timeout: 30 * time.Second}
  res, err := client.Do(req)
  if err != nil { panic(err) }
  defer res.Body.Close()
  body, err := io.ReadAll(res.Body)
  if err != nil { panic(err) }
  fmt.Println(res.Status, string(body))
}
```

### C#

```csharp
// .NET 6 or later
using System;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;

using var client = new HttpClient { Timeout = TimeSpan.FromSeconds(30) };
using var content = new StringContent(@"{""jsonrpc"":""2.0"",""method"":""loginByEmailVerification"",""params"":{""email"":""YOUR_EMAIL_ADDRESS"",""code"":""123456"",""authenticationMethod"":""EMAIL_CODE""},""id"":1}", Encoding.UTF8, "application/json");
using var response = await client.PostAsync(@"https://api-v2.financesavi.com/rpc", content);
Console.WriteLine($"HTTP {(int)response.StatusCode}");
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

### Java

```java
// Java 11+: save as SaviExample.java, then run java SaviExample.java
import java.net.URI;
import java.net.http.*;
import java.time.Duration;

class SaviExample {
  public static void main(String[] args) throws Exception {
    var client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(30)).build();
    var builder = HttpRequest.newBuilder(URI.create("https://api-v2.financesavi.com/rpc"))
        .timeout(Duration.ofSeconds(30))
        .header("Content-Type", "application/json");
    var request = builder.POST(HttpRequest.BodyPublishers.ofString("{\"jsonrpc\":\"2.0\",\"method\":\"loginByEmailVerification\",\"params\":{\"email\":\"YOUR_EMAIL_ADDRESS\",\"code\":\"123456\",\"authenticationMethod\":\"EMAIL_CODE\"},\"id\":1}")).build();
    var response = client.send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println("HTTP " + response.statusCode());
    System.out.println(response.body());
  }
}
```

### PHP

```php
<?php
// Requires the PHP cURL extension.
$curl = curl_init('https://api-v2.financesavi.com/rpc');
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CONNECTTIMEOUT => 30,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"jsonrpc":"2.0","method":"loginByEmailVerification","params":{"email":"YOUR_EMAIL_ADDRESS","code":"123456","authenticationMethod":"EMAIL_CODE"},"id":1}',
]);
$body = curl_exec($curl);
if ($body === false) {
    throw new RuntimeException(curl_error($curl));
}
echo "HTTP " . curl_getinfo($curl, CURLINFO_HTTP_CODE) . PHP_EOL;
echo $body . PHP_EOL;
curl_close($curl);
```

### Ruby

```ruby
require 'net/http'
require 'uri'

uri = URI('https://api-v2.financesavi.com/rpc')
request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/json'
request.body = '{"jsonrpc":"2.0","method":"loginByEmailVerification","params":{"email":"YOUR_EMAIL_ADDRESS","code":"123456","authenticationMethod":"EMAIL_CODE"},"id":1}'
response = Net::HTTP.start(uri.host, uri.port,
  use_ssl: uri.scheme == 'https', open_timeout: 30, read_timeout: 30, write_timeout: 30
) { |http| http.request(request) }
puts "HTTP #{response.code}"
puts response.body
```

### Swift

```swift
// Swift 5.5+: save as SaviExample.swift, then run swift SaviExample.swift
import Foundation
#if canImport(FoundationNetworking)
import FoundationNetworking
#endif

var request = URLRequest(url: URL(string: "https://api-v2.financesavi.com/rpc")!)
request.httpMethod = "POST"
request.timeoutInterval = 30
request.setValue("application/json", forHTTPHeaderField: "Content-Type")
request.httpBody = Data("{\"jsonrpc\":\"2.0\",\"method\":\"loginByEmailVerification\",\"params\":{\"email\":\"YOUR_EMAIL_ADDRESS\",\"code\":\"123456\",\"authenticationMethod\":\"EMAIL_CODE\"},\"id\":1}".utf8)
let configuration = URLSessionConfiguration.ephemeral
configuration.timeoutIntervalForResource = 30
let session = URLSession(configuration: configuration)
let (data, response) = try await session.data(for: request)
if let http = response as? HTTPURLResponse { print("HTTP", http.statusCode) }
print(String(decoding: data, as: UTF8.self))
```

### Local API capture (scrubbed) (HTTP 200)

```json
{
  "jsonrpc": "2.0",
  "result": {
    "token": "<ACCESS_TOKEN>",
    "userId": "user_8f3a1c2d9b"
  },
  "id": 1
}
```

Source: https://financesavi.com/developers/api/loginByEmailVerification