Verify Email — POST /api/merchant/verify

The verify endpoint completes merchant onboarding. Confirm the email address with the six-character code you received at signup, and FlareHQ marks the account verified, provisions a Circle-managed payout wallet, and issues your API key. The API key is returned only once — save it immediately, it is not shown again.

Endpoint

POST https://flarehq.xyz/api/merchant/verify

Request

Headers

Header	Value
`Content-Type`	`application/json` — required

No authentication is required — the email plus code pair is the credential.

Body Parameters

string

required

The email the account was registered with.

string

required

The verification code emailed at signup. Expires 10 minutes after it is issued.

Response

boolean

true on a successful verification.

string

Human-readable confirmation — "Account verified successfully."

object

Summary of the now-verified merchant.

Show merchant fields

string

Unique merchant identifier.

string

The merchant’s email address.

string

The merchant’s registered display name.

string

Payout wallet provider. "CIRCLE" for the default Circle-managed flow.

string

The provisioned payout wallet address (null for external-wallet merchants).

string

ISO timestamp of account creation.

string

The merchant’s API key, generated at verification time (prefixed arc_live_... in the current implementation). Use it as the x-api-key header value on API-style calls such as GET /api/merchant/dashboard and GET/POST /api/merchant/wallet/connect. Shown only once.

string

"Save your API key now. It will not be shown again."

Examples

curl -X POST https://flarehq.xyz/api/merchant/verify \
  -H "Content-Type: application/json" \
  -d '{
    "email": "merchant@example.com",
    "code": "123456"
  }'

const res = await fetch('https://flarehq.xyz/api/merchant/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    email: 'merchant@example.com',
    code: '123456',
  }),
});

const { success, merchant, apiKey } = await res.json();
// Persist apiKey somewhere safe — it will not be returned again

Success Response

{
  "success": true,
  "message": "Account verified successfully.",
  "merchant": {
    "id": "8f2c9a41-9d07-4c3e-b2a6-5f1e0c8b7d99",
    "email": "merchant@example.com",
    "businessName": "Acme Store",
    "walletProvider": "CIRCLE",
    "walletAddress": "0x4a2F1b9c7dE03A6b8C5f2e9D1a4c7B6e3F9d2A8",
    "createdAt": "2026-08-16T10:00:00.000Z"
  },
  "apiKey": "arc_live_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b",
  "warning": "Save your API key now. It will not be shown again."
}

Error Responses

{
  "success": false,
  "error": "No account found for this email."
}

{
  "success": false,
  "error": "This account is already verified."
}

{
  "success": false,
  "error": "Invalid verification code."
}

{
  "success": false,
  "error": "Verification code has expired. Please sign up again to get a new one."
}

Notes

The Circle payout wallet is provisioned during this call for CIRCLE-provider merchants. If wallet provisioning fails, the account stays unverified and the API returns HTTP 500 with "Verification succeeded but wallet setup failed. Please contact support."

The returned apiKey is displayed exactly once and then hidden. There is no endpoint that returns it again — the profile route GET /api/merchant/me only reveals a masked hint. Store the key securely immediately after verification.

Overview

Payments

Escrow

Streaming

CCTP Bridge

Checkout

x402

Agents

Jobs

Merchant

Consumer

Payroll

Verify Email — POST /api/merchant/verify

Endpoint

Request

Headers

Body Parameters

Response

Examples

Success Response

Error Responses

Notes

​Endpoint

​Request

​Headers

​Body Parameters

​Response

​Examples

​Success Response

​Error Responses

​Notes

Endpoint

Request

Headers

Body Parameters

Response

Examples

Success Response

Error Responses

Notes