---
title: "Validate a bearer token."
method: POST
path: "/oauth/validate"
tags: ["OAuth"]
---

# Validate a bearer token.

`POST /oauth/validate`

Check if a given bearer token is valid and unexpired.
**Note that** the bearer token MUST be sent in the JSON body; it CANNOT be sent as an Authorization header.

## Request body

- object
  - `bearer_token` string, required — OAuth bearer token in JWT format.

## Response `200`

Successful result when given a valid, non-expired bearer token.

- object
  - `valid` boolean, required
  - `application_active` boolean, required
  - `expires` number, required — Expiration time, in **milliseconds** past the epoch.

## Other responses

- `400` — unresolved $ref
- `401` — Invalid or expired bearer token.

---

[API](https://skmtc.dev/alloy/apis/alloy-api.md) · [All operations](https://skmtc.dev/alloy/apis/alloy-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/alloy/alloy-api/revisions/405799de4d2a/schema)