Verification codes

Email the merchant the verification code a dangerous change asks for, so admin tokens and connected AI tools can make it.

Some changes are confirmed with a verification code, exactly as in Store Admin: removing a domain, setting up DNS with Tringify, saving, deleting, bulk deleting and importing DNS records, unassigning a domain, setting or clearing the primary domain, and sending-domain, sender address, reply-to and MAIL FROM changes. Each endpoint that takes otp_code names the exact action, target_type and target_id its code must be requested for.

The verification flow. 1. Get the merchant's approval for the change. 2. Call Request a verification code with the action, target_type and target_id the endpoint names (in the hosted MCP, request_verification_code). Tringify emails a code to the token's member: the person who created the admin token, or the merchant who approved the MCP connection. 3. Tell the merchant where it went (sent_to, masked) and ask them for the code. 4. Call the endpoint with the code as otp_code before expires_at.

The code is the one Store Admin sends, with the same format, expiry, attempt limit and binding: it works once, only for the action and target it was requested for, and requesting again replaces it. A wrong, expired, used or mismatched code is refused with DANGEROUS_CODE_INVALID (DOMAIN_REMOVAL_OTP_INVALID when removing a domain); request a new one. Wait until resend_available_at before requesting again for the same action and target. Requests are limited per member and per store with the limits Store Admin uses; a limited request returns THROTTLE_COOLDOWN_WAIT or THROTTLE_LIMIT_TRY_IN_WAIT with the wait. The code never appears in a response, and every request is recorded in the store's activity log with the token or connection that made it.

Only merchant credentials can request codes: Store Admin tokens and the merchant's own MCP connection. App tokens are refused. The request needs the scope of the endpoint the code is for (write_domains or write_email_settings), and the member needs the Store Admin permission for that change. Tokens and connected tools get the code by email only; passkey confirmation is for Store Admin.

Endpoints#

Request a verification code

POST Admin tokens only

Email the merchant a verification code for one dangerous action on one target.

Tringify emails a verification code to the token's member: the person who created the admin token, or the merchant who approved the MCP connection. It is the same code Store Admin sends before a dangerous change, with the same expiry, attempts and binding: it works once, only for the action and target it was requested for. Ask the merchant for the code and send it as otp_code to the endpoint that names this action. Each endpoint that takes otp_code names the exact action, target_type and target_id to request. The response says where the code went (sent_to, masked), when it expires (expires_at) and when another code can be requested for the same action and target (resend_available_at), both RFC 3339 in the store's timezone with its offset. It never contains the code. Requesting again replaces the earlier code for that action and target. The checks the change itself makes before anything else (for example DOMAIN_ASSIGNED_TO_STOREFRONT for remove_domain) run here too, so no code is sent for a change that would be refused. The request needs the scope of the endpoint the code is for, and the member needs the Store Admin permission for that change. Requests are limited per member and per store; a limited request returns the wait. Tokens and connected tools get the code by email only: passkey confirmation is for Store Admin. Every request is recorded in the store's activity log. Actions: add_email_address (target_type email_identity, needs write_email_settings); add_email_domain (target_type email_identity, needs write_email_settings); clear_primary_domain (target_type storefront, needs write_domains); delete_email_address (target_type email_address, needs write_email_settings); delete_email_domain (target_type email_domain, needs write_email_settings); dns_bulk_delete (target_type dns_zone, needs write_domains); dns_delete (target_type dns_zone, needs write_domains); dns_import (target_type dns_zone, needs write_domains); dns_manage (target_type domain, needs write_domains); dns_save (target_type dns_zone, needs write_domains); email_mail_from (target_type email_identity, needs write_email_settings); email_reply_to (target_type email_identity, needs write_email_settings); remove_domain (target_type domain, needs write_domains); restart_email_domain (target_type email_domain, needs write_email_settings); set_default_email_address (target_type email_address, needs write_email_settings); set_primary_domain (target_type domain, needs write_domains); unassign_domain (target_type domain, needs write_domains).

Headers

Name	Type	Description
`Authorization` required	`string`	Bearer Store API token.

Body parameters

Name	Type	Description
`action` required	`string`	The dangerous action the code is for, exactly as the endpoint that consumes it names it. Allowed values `add_email_addressadd_email_domainclear_primary_domaindelete_email_addressdelete_email_domaindns_bulk_deletedns_deletedns_importdns_managedns_saveemail_mail_fromemail_reply_toremove_domainrestart_email_domainset_default_email_addressset_primary_domainunassign_domain` Example: `remove_domain`
`target_type` required	`string`	The target type the endpoint names for this action. Allowed values `dns_zonedomainemail_addressemail_domainemail_identitystorefront` Example: `domain`
`target_id` required	`string`	The target id, built exactly as the endpoint describes (for most actions the id in its path). Example: `3f0d9a8e-6a7b-4c2d-9e1f-5a4b3c2d1e0f`

Errors

401 UNAUTHORIZED
Authorization header missing, malformed, or token invalid/expired.
402 SUBSCRIPTION_REQUIRED
The store does not have an active or trialing subscription.
403 STORE_API_SCOPE_REQUIRED
Token is valid but lacks the required scope for this call. The token lacks the scope of the endpoint the code is for (listed with each action).
429 RATE_LIMITED
The token's request allowance is exhausted. Retry after the Retry-After header.
403 STORE_API_ADMIN_TOKEN_REQUIRED
App tokens cannot request verification codes.
403 PERMISSION_DENIED
The token's member lacks the Store Admin permission for the change.
400 DANGEROUS_ACTION_INVALID
action is not one of the listed actions.
400 DANGEROUS_ACTION_TARGET_REQUIRED
target_type or target_id is missing, or target_type does not match the action.
404 NOT_FOUND
The target does not exist in this store.
404 DOMAIN_NOT_FOUND
The domain does not belong to this store.
429 THROTTLE_COOLDOWN_WAIT
A code for this action and target was sent moments ago; the message says how long to wait.
429 THROTTLE_LIMIT_TRY_IN_WAIT
The member or the store requested too many codes for this action; the message says when to try again.
400 STORE_API_BODY_PROPERTY_UNKNOWN
The body has a property this request does not accept. The message and error.details.properties list the allowed and required properties (nested for each object or list of objects).
400 STORE_API_BODY_PROPERTY_INVALID
A body property has the wrong type (error.details.expected_type). The message and error.details.properties list the allowed and required properties.

curl -X POST 'https://api-store.tringify.com/api/2025-01/verification-codes' \
  -H "Authorization: Bearer YOUR_STORE_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "action": "remove_domain",
  "target_id": "3f0d9a8e-6a7b-4c2d-9e1f-5a4b3c2d1e0f",
  "target_type": "domain"
}'

const res = await fetch("https://api-store.tringify.com/api/2025-01/verification-codes", {
  method: "POST",
  headers: {"Authorization":"Bearer YOUR_STORE_API_TOKEN","Content-Type":"application/json"},
  body: JSON.stringify({
    "action": "remove_domain",
    "target_id": "3f0d9a8e-6a7b-4c2d-9e1f-5a4b3c2d1e0f",
    "target_type": "domain"
  }),
});
const data = await res.json();

import requests

res = requests.post(
    "https://api-store.tringify.com/api/2025-01/verification-codes",
    headers={"Authorization":"Bearer YOUR_STORE_API_TOKEN"},
    json={
        "action": "remove_domain",
        "target_id": "3f0d9a8e-6a7b-4c2d-9e1f-5a4b3c2d1e0f",
        "target_type": "domain",
    },
)
data = res.json()

Response

200

Sample response

{"success":true,"code":"VERIFICATION_CODE_SENT","data":{"action":"remove_domain","target_type":"domain","target_id":"3f0d9a8e-6a7b-4c2d-9e1f-5a4b3c2d1e0f","sent_to":"m***@example.com","expires_at":"2026-10-27T10:15:00-04:00","resend_available_at":"2026-10-27T10:01:00-04:00"}}