---
title: "Verify the code"
method: POST
path: "/api/v2/connect/verify"
tags: ["Connect"]
---

# Verify the code

`POST /api/v2/connect/verify`

Checks the code the user entered and, on success, connects the user and returns the token pair to store. Completing the code **is** the authorization — there is no separate approval screen.

The returned `access_token` is the **user's connection token**: it acts on behalf of this user (send it as the bearer token to the MCP server to create cards, check balances, and shop as them). It is not the platform token — the endpoints in this reference keep using your platform access token and name the user with `user_id`.

A code can be verified once: a second verify of the same attempt returns `invalid_connect_attempt`.

In **sandbox** the code is always `111111`.

## Request body

- object
  - `connect_id` string, required — The `id` returned by `/connect/start`.
  - `code` string, required — The one-time code the user entered. Always `111111` in sandbox.

## Response `200`

The connection. Store the token pair and `user.id` — every KYC call names the user by it.

- Connection
  - `object` 'connection'
  - `access_token` string — The user's connection token — store it to act on their behalf. Send it as the bearer token to the MCP server; never in the `Authorization` header of these endpoints.
  - `refresh_token` string — Use it with `/connect/refresh` to get a new pair before the access token expires.
  - `token_type` 'Bearer'
  - `expires_in` integer — Seconds until the access token expires (3600 = one hour).
  - `user` object — The connected user. Store `id` — every KYC call names the user by it.
    - `id` string
    - `email` string, nullable — Set when the user connected by email, otherwise `null`.
    - `phone` string, nullable — Set when the user connected by phone, otherwise `null`.

## Other responses

- `400` — `invalid_request` — missing `connect_id` or `code`. `invalid_connect_attempt` — the attempt is unknown, already used, or expired. `client_credentials_required` — the token wasn't minted from client credentials.
- `401` — `invalid_code` — that code is invalid or expired.
- `502` — `auth_provider_error` — verification failed downstream. Try again.

---

[API](https://skmtc.dev/agentcard/apis/agentcard-api.md) · [All operations](https://skmtc.dev/agentcard/apis/agentcard-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/agentcard/agentcard-api/revisions/638d12c8303f/schema)