---
title: "Verify a delegate token"
method: POST
path: "/api/board/verify-user"
tags: ["Board"]
---

# Verify a delegate token

`POST /api/board/verify-user`

## Request

- Base URL: `https://core-api.getaptly.com`
- URL: `https://core-api.getaptly.com/api/board/verify-user`
- Auth: API key in header `x-token`
- TypeScript: <https://skmtc.dev/getaptly/apis/aptly-api/docs/api/board/verify-user/post.ts> (a function with typed inputs; its response is checked against the schema)

Validates a short-lived delegate token issued by `POST /api/platform/user-token`.
Checks the JWT signature, expiry, and confirms the token was issued for the same
company as the API key. Use this to confirm the identity of an authenticated Aptly
user inside an embedded plugin or iframe.

## Request body

- object
  - `token` string, required: Delegate token returned by `POST /api/platform/user-token`.

## Response `200`

Token is valid. Returns the user identity.

- object
  - `userId` string
  - `email` string, nullable
  - `firstName` string, nullable
  - `lastName` string, nullable
  - `companyId` string

## Other responses

- `400`: token field is missing.
- `401`: Invalid or missing API key, or delegate token is invalid/expired/wrong company.

---

[API](https://skmtc.dev/getaptly/apis/aptly-api.md) - [All operations](https://skmtc.dev/getaptly/apis/aptly-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaptly/apis/aptly-api/revisions/75c367e0b8e5?raw)