Go to developer

OAuth Verify / Validate verification token

Validate verification token

POST/verify/validate

One-shot server validation. Pass access_token as verification_token. Replay returns 409. Create your app session only after valid: true.

Authentication

SERVER ONLY

verification_token (+ optional client_id) — No partner secret. Call from your backend with the token from token exchange.

Request

Request body

Content-Type: application/json · required

  • client_idstring

    Optional; when set must match the token's client

  • verification_tokenstringrequired

    Use access_token from POST /oauth/token

Response

200 Token valid and consumed

  • client_idstring
  • expires_atstring (date-time)
  • userobjectrequired
    • accessRolestringnullable
    • emailstringnullable
    • fullNamestringnullable
    • idinteger | stringrequired
    • isAdminbooleannullable
    • phonestringnullable
    • rolestringnullable
  • validbooleanrequired

    Enum: true

  • verification_idstring

400 verification_token missing

  • errorstring
  • error_descriptionstring
  • validboolean

401 invalid_verification_token or invalid_client

  • errorstringrequired

    Enum: invalid_verification_token, invalid_client, verification_token_already_used

  • validbooleanrequired

    Enum: false

409 Token already consumed

  • errorstringrequired

    Enum: invalid_verification_token, invalid_client, verification_token_already_used

  • validbooleanrequired

    Enum: false

Errors

ErrorHTTPMeaningFix
invalid_verification_token401Unknown, expired, or malformed tokenSend fresh access_token from /oauth/token Diagnose →
invalid_client401client_id does not match tokenOmit client_id or match the starting publishable id Diagnose →
verification_token_already_used409Token already consumedStart a new login; do not retry validate Diagnose →

SDK equivalent

Examples

Bash
curl -X POST "https://auth.keyra.ie/verify/validate" \
  -H "Content-Type: application/json" \
  -d '{"verification_token":"oat_xxxxxxxx","client_id":"cp_test_xxxxxxxx"}'

Response

response.jsonJSON
{
  "valid": true,
  "verification_id": "tok_row_id",
  "client_id": "cp_test_xxxxxxxx",
  "expires_at": "2026-08-05T12:00:00.000Z",
  "user": {
    "id": "usr_123",
    "phone": "+15551234567",
    "fullName": "Ada Lovelace",
    "email": "ada@example.com"
  }
}