Account stage — send a one-time sign-in code (POST /auth/check-email).

beycome is passwordless — never ask the user for a password. This emails the user a 6-digit code (a second, different code also goes out by SMS; either one works). Ask the user for the code they received, then exchange it for the access_token with beycome_signin_verify.

Read the response body, not the HTTP status — the envelope's ok mirrors the HTTP status, and auth failures here still return 2xx. Always check data.success:

• success: true (201, "Email sent") — code sent; ask the user for it.

• success: false with "Email not found." (HTTP 200, ok: true) — no account for this email; run beycome_signup instead (signup also sends a code).

• HTTP 422 (ok: false) — the email matched a secondary address; the body still matters: it hints the masked primary login email to use instead.

Codes stay valid for 30 minutes. Re-running this tool sends a fresh code and invalidates the old one. Rate-limited (5/min and 100/day per email) — never call it in a loop or as an automatic retry.