Email a one-time sign-in code

Starts a sign-in by emailing a six-digit code to the address given. Confirm it with POST /v1/sign-ins/{sign_in_id}/confirmation to get a key. This creates the account if the address is new, and adds a key to the account if it is not.

The response is identical whether or not an account exists. Anything else would let this endpoint answer "is this person a customer?" for any email address.

Every request spends a solved challenge from POST /v1/sign-in-challenges, passed as altcha. After that:

• One code per address per minute. Asking again sooner is 429 with Retry-After.
• One open sign-in per address. A new code cancels the previous one, which then answers 410. Holding several codes open would otherwise multiply the attempts.
• A code expires ten minutes after it is sent, can be used once, and allows five attempts.
• Requests are also rate-limited per email address and per IP.
• A global cap on sign-in emails per hour answers 503 when reached.

The email says plainly that we never ask for the code, and shows when and from where the request was made, so its owner can tell whether it was theirs. This is the only way into the API that requires no key.

curl -X POST https://api.einvoicing.dev/v1/sign-ins \  -H "Content-Type: application/json" \  -d '{"email":"[email protected]","altcha":"<altcha>"}'

<?php$client = new GuzzleHttp\Client();$response = $client->request('POST', 'https://api.einvoicing.dev/v1/sign-ins', [    'headers' => [        'Accept' => 'application/json',    ],    'json' => [        'email' => '[email protected]',        'altcha' => '<altcha>',    ],]);$data = json_decode((string) $response->getBody(), true)['data'];

payload := `{  "email": "[email protected]",  "altcha": "<altcha>"}`req, _ := http.NewRequest(http.MethodPost, "https://api.einvoicing.dev/v1/sign-ins", strings.NewReader(payload))req.Header.Set("Content-Type", "application/json")res, err := http.DefaultClient.Do(req)if err != nil {	log.Fatal(err)}defer res.Body.Close()

const res = await fetch("https://api.einvoicing.dev/v1/sign-ins", {  method: "POST",  headers: {    "Content-Type": "application/json",  },  body: JSON.stringify({    "email": "[email protected]",    "altcha": "<altcha>"  }),});const { data } = await res.json();

{  "data": {    "id": "01J9Z3K4Q7VN3XW2R5T6Y8B0CD",    "email": "[email protected]",    "expires_at": "2026-09-11T14:13:11.482Z"  }}