---
title: "Auth Api Strategy Authed"
method: GET
path: "/auth:checkAuth"
tags: ["Authentication"]
---

# Auth Api Strategy Authed

`GET /auth:checkAuth`

Tell the SDK whether its current token can reach `workspace`, and if not, whether re-auth would help.

The caller is already authenticated; the only question is whether their token is scoped to the right
WorkOS org for this workspace. Returns one of three outcomes:

1. `AuthorizedResponse`: the token already works for this workspace, the user is signed into it, or is a
  cradle employee (`platform.inspect`) whose access is identity-based regionally regardless of org scope.
2. `UnauthorizedResponse(can_reauth=True, org_id=...)`: the token is valid but scoped to the wrong org; the
  user is a member of the workspace's org, so the SDK should refresh its token against `org_id`.
3. `UnauthorizedResponse(can_reauth=False)`: the workspace doesn't exist in WorkOS, or the user has no
  membership to re-scope to, re-auth wouldn't help, so the SDK just proceeds on its existing token.

## Query parameters

- `workspace` string, required

## Response `200`

Successful Response

- union
  - UnauthorizedResponse
    - `authorized` false
    - `can_reauth` boolean, required
    - `org_id` string, nullable, required
  - AuthorizedResponse
    - `authorized` true

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/cradle/apis/cradle-api.md) · [All operations](https://skmtc.dev/cradle/apis/cradle-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cradle/cradle-api/revisions/b0b5b6bfaed8/schema)