Verify Signup

Present the six-digit code the guest received. On a match the account becomes ACTIVE, gets its wallet, and can hold rewards.

POSThttps://kicbak.co/api/third-party/v1/kicbak/signup/verify

Authentication

Every request needs a bearer token in the Authorization header — the same credential that made the signup.

Headers

Field	Type	Required	Description
Authorization	string	required	Bearer token obtained from POST /api/third-party/v1/auth/token, e.g. "Bearer eyJhbGci...".
Content-Type	string	required	application/json

Request body

Field	Type	Required	Description
email	string	required	The email you signed up.
code	string	required	The six-digit code the guest received (or, with a sandbox credential, the verificationCode from the signup response).

Retries are safe

Verifying an account that is already active is a success with replay: true, so a retry after a timeout never reports a failure for work that was done. Each code allows five wrong attempts and lives for fifteen minutes; after either, call the signup endpoint again to issue a new one.

Code examples

bash

curl -X POST "https://kicbak.co/api/third-party/v1/kicbak/signup/verify" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "email": "ada@example.com", "code": "482913" }'

Responses

Every response is JSON with a status field (1 success, 0 failure). Failures also carry a code your error handler can branch on — it never changes if we reword message.

json

{
  "status": 1,
  "message": "Account activated.",
  "data": { "email": "ada@example.com", "username": "ada", "status": "ACTIVE" }
}

Error reference

Status	Code	Meaning
400	INVALID_CODE	The code does not match. Each code allows five attempts; after that it is discarded.
400	CODE_EXPIRED	No live code for this email — it expired (15 minutes) or was used up. Call the signup endpoint again.
400	TOO_MANY_ATTEMPTS	Five wrong codes in a row. The code is discarded; issue a new one via the signup endpoint.
409	NOT_PENDING	The account exists but is not waiting on a code (for example, it was blocked). Nothing you send will activate it.
401	UNAUTHORIZED	No readable credential, or a token that doesn't decode/validate.
401	TOKEN_EXPIRED	Token aged out. Re-exchange the same client_key/client_secret and retry.
401	CREDENTIAL_ROTATED	This token was minted under a secret that has since been rotated. Exchange your new secret.
401	CREDENTIAL_EXPIRED	The credential itself is past its own expiry — re-exchanging will not help; request a new credential.
401	CLIENT_INACTIVE	The client has been deactivated.
503	SANDBOX_UNAVAILABLE	You are using a sandbox credential and the sandbox environment is temporarily unavailable on our side. Retry shortly; production credentials are unaffected.
429	—	More than 300 verifications in an hour from this client.
500	INTERNAL_ERROR	Unexpected server error. Safe to retry.