Public API

/activate.ashx · public API

Single-purpose endpoint that consumes the one-time activation token emailed by /signup.ashx. Hitting the URL exactly once flips the user's disabled flag and redirects to the login page.

The token is the only secret here. Anyone who can read the user's email can activate the account, by design — just like every consumer signup flow on the open web. Tokens are 43+ urlsafe-base64 characters, single-use, and expire after 7 days. Personal data handling is described in the public privacy notice.

GET `/activate.ashx?token=<token>` #

Consume a one-time activation token. The token was generated by /signup.ashx and sent to the user’s email. Hitting this URL flips the user's disabled flag to false and removes the token from the store.

Request

Query: token (43+ chars, urlsafe base64).

Response

200 text/html success page. The page contains a meta-refresh + JavaScript redirect to /login.html so a single click activates AND lands the user on the login screen.

Errors

400 friendly HTML page when the token is missing, malformed, expired (>7 days), already used, or the user record was deleted in the meantime.

Example

https://phone.codeb.io/activate.ashx?token=abc123…

Token is single-use — even if leaked from the user’s inbox, it can be redeemed only once. Activation also triggers a one-shot Nextcloud-welcome email to the user (if configured).