GET /activate.ashx?token=<token> #
Consume a one-time activation token. The token was generated by /signup.ashx and sent to the user’s email. Hitting this URL flips the user's disabled flag to false and removes the token from the store.
Request
Query: token (43+ chars, urlsafe base64).
Response
200 text/html success page. The page contains a meta-refresh + JavaScript redirect to /login.html so a single click activates AND lands the user on the login screen.
Errors
400 friendly HTML page when the token is missing, malformed, expired (>7 days), already used, or the user record was deleted in the meantime.
Example (verified 2026-06-05)
# 1) The signup flow generates and emails a token; the link in the email is: https://phone.codeb.io/activate.ashx?token=abc123… # 2) The token is consumed on the FIRST GET; a second GET returns 400. $ curl -i "https://phone.codeb.io/activate.ashx?token=invalid" HTTP/1.1 400 Bad Request Content-Type: text/html; charset=utf-8 <!DOCTYPE html><html>…Activation link is invalid or expired…
Programmatic clients normally do not call this endpoint — the activation link is delivered to the user’s inbox and opened in a browser. The 200 success page contains a meta-refresh that lands the user on /login.html.