Skip to main content
POST
auth.token.verify

Authorizations

Authorization
string
header
required

API key: sk_live_…

Headers

Idempotency-Key
string

Optional. A retry with the same key returns the stored result.

Maximum string length: 255
Pramaan-Account
string

Optional. One of your account ids (GET /v1/accounts): run on that account, whatever your routing rules say. The response header X-Pramaan-Account names the account that ran.

Pramaan-End-User
string

Optional. Your own tag for your end user: a sticky: end_user rule keeps them on the account that first served them.

Maximum string length: 256
Pramaan-End-User-Group
string

Optional. Your end user's group, matched by rules with endUserGroup.

Maximum string length: 64

Body

application/json
token
string
required

The session token (a signed JWT) sent by the signed-in user's browser or app.

Required string length: 1 - 8192
audience
string

Required audience (aud claim), when your app sets one.

Required string length: 1 - 512
authorizedParties
string[]

Allowed origins for the azp claim (the page that requested the token), 1 to 20.

Required array length: 1 - 20 elements

An allowed origin, e.g. https://app.example.com.

Required string length: 1 - 2048

Response

The result

valid
boolean
required

True when the token is genuine, unexpired and passes your checks.

userId
string

The user the token is for. Only when valid.

sessionId
string

The session the token belongs to, when known.

orgId
string

The active organization, when the token has one.

expiresAt
string

When the token expires, ISO 8601.