Email signup: verify-code now returns a setupToken
POST /api/auth/verify-code (and the emailed verification link) now returns a single-use setupToken, valid for 30 minutes. It proves that the person setting the password owns the email address.
Pass it to POST /api/auth/set-password together with the email and password:
{ "email": "you@example.com", "password": "<choose one>", "setupToken": "<from verify-code>" }
What you need to do. If you script or automate signup (agents, CLI-style flows), send the token from the verify step. It has been required since 2026-10-04 15:23 UTC: a set-password request without a valid token is rejected with 401. See the announcement.
Accounts that sign in with Google or through the Gluo portal cannot have a password set through this endpoint.
Documentation changed