Ask for a login code.
POST/api/auth/login
Always answers 200, whether or not the address is one we have seen. Telling a caller which addresses exist is an account enumeration, and the person who actually owns the address learns the same thing from their inbox.
Request
Responses
- 200
- 400
- 502
a code is on its way; in dev mode it is in the body
that is not an email address
the mail provider refused it