---
title: "Validate a Configure OAuth agent token"
method: POST
path: "/v1/auth/sign-in/validate"
tags: ["Auth"]
---

# Validate a Configure OAuth agent token

`POST /v1/auth/sign-in/validate`

## Request

- Base URL: `https://api.configure.dev`
- URL: `https://api.configure.dev/v1/auth/sign-in/validate`
- Auth: API key in header `X-API-Key`

Server-side validation for agent-scoped tokens returned by Configure OAuth. Use this to restore host-app sessions; /v1/me accepts user-scoped JWTs and is not the SSO session validator.

## Headers

- `X-Agent` string

## Request body

- SignInValidateRequest
  - `token` string, required: Agent-scoped JWT returned by hosted sign-in exchange, message completion, or phone recognition.

## Response `200`

Validation result.

- SignInValidateResponse
  - `valid` boolean, required
  - `userId` string: Present when valid is true.
  - `tokenUse` 'agent'
  - `approved` boolean
  - `agent` string

## Other responses

- `400`: Request shape is invalid.
- `403`: Forbidden. Common causes include secret_key_required, token_wrong_type, approval_required, or access_denied.

---

[API](https://skmtc.dev/configure/apis/configure-http-api.md) · [All operations](https://skmtc.dev/configure/apis/configure-http-api/llms.txt) · [OpenAPI document](https://skmtc.dev/configure/apis/configure-http-api/revisions/ec760a9533d2?raw)