Skip to main content
POST
/
api
/
v1
/
pub
/
{project_id}
/
auth
/
verify
Verify access token
curl --request POST \
  --url https://org-api.hexoforge.dev/api/v1/pub/{project_id}/auth/verify \
  --header 'X-API-Key: <api-key>'
{
  "valid": true,
  "user_id": "<string>",
  "roles": [
    "<string>"
  ],
  "permissions": [
    "<string>"
  ]
}

Documentation Index

Fetch the complete documentation index at: https://orchestrator-docs.hexoforge.dev/llms.txt

Use this file to discover all available pages before exploring further.

Validates the access token in Authorization and returns claims. Requires X-API-Key and Bearer token.
Send both X-API-Key and Authorization: Bearer with the token under test.

​
Response

200 OK 
{
  "valid": true,
  "user_id": "550e8400-e29b-41d4-a716-446655440000",
  "roles": ["user", "editor"],
  "permissions": ["read:posts", "write:posts"]
}
​
valid
boolean
Whether the token is currently valid.
​
user_id
string
Present when valid is true.
​
roles
string[]
Role slugs when valid.
​
permissions
string[]
Permission slugs when valid.

​
Status codes

CodeMeaning
200Body describes validity
401Token invalid, expired, or revoked