beycome_signin_start

com.beycome/listing · Verify this server

Account stage — send a one-time sign-in code (POST /auth/check-email). beycome is passwordless — never ask the user for a password. This emails the user a 6-digit code (a second, different code also goes out by SMS; either one works). Ask the user for the code they received, then exchange it for the access_token with `beycome_signin_verify`. Read the response body, not the HTTP status — the envelope's ``ok`` mirrors the HTTP status, and auth failures here still return 2xx. Always check ``data.success``: - ``success: true`` (201, "Email sent") — code sent; ask the user for it. - ``success: false`` with "Email not found." (HTTP 200, ``ok: true``) — no account for this email; run `beycome_signup` instead (signup also sends a code). - HTTP 422 (``ok: false``) — the email matched a secondary address; the body still matters: it hints the masked primary login email to use instead. Codes stay valid for 30 minutes. Re-running this tool sends a fresh code and invalidates the old one. Rate-limited (5/min and 100/day per email) — never call it in a loop or as an automatic retry.