---
title: "Verify a delegate token (keyless)"
method: POST
path: "/api/app/verify"
tags: ["App"]
---

# Verify a delegate token (keyless)

`POST /api/app/verify`

## Request

- Base URL: `https://core-api.getaptly.com`
- URL: `https://core-api.getaptly.com/api/app/verify`
- Auth: none required
- TypeScript: <https://skmtc.dev/getaptly/apis/aptly-api/docs/api/app/verify/post.ts> (a function with typed inputs; its response is checked against the schema)

Validates a short-lived delegate token without requiring an API key. The token must
include an `appClientId` (i.e. it was issued for an embedded app via
`POST /api/platform/user-token`). Returns the user's identity, company name, and
the app's title.

## Request body

- object
  - `token` string, required: Delegate token returned by `POST /api/platform/user-token`.

## Response `200`

Token is valid.

- object
  - `userId` string
  - `email` string, nullable
  - `firstName` string, nullable
  - `lastName` string, nullable
  - `companyId` string
  - `companyName` string, nullable
  - `appClientId` string
  - `appTitle` string, nullable

## Other responses

- `400`: token field is missing.
- `401`: Token is invalid, expired, or was not issued for an embedded app (missing appClientId).

---

[API](https://skmtc.dev/getaptly/apis/aptly-api.md) - [All operations](https://skmtc.dev/getaptly/apis/aptly-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaptly/apis/aptly-api/revisions/75c367e0b8e5?raw)