---
title: "Verify Endpoint"
method: POST
path: "/api/verify"
tags: ["scan"]
---

# Verify Endpoint

`POST /api/verify`

## Request

- Base URL: `https://api.scanforai.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.scanforai.com/api/verify`
- Auth: none declared

Trade a Turnstile token for a scan pass. Proving browser-ness is now its own
step, not a passenger on the first scan.

It used to only happen INSIDE /api/scan, which forced the client to hold the
scan until a token existed — www waits up to 2.8s for the widget and then scans
without one anyway, so a slow link silently bought the weak engine. Verification
can now finish while the user is still typing, and the pass applies from the
first scan onward.

Returns the pass in the BODY as well as a cookie: the cookie is third-party for
every one of our clients (page scanforai.com, API api.scanforai.com), so it is
the copy most likely to be discarded. Clients keep the string and send it back
as X-Scan-Pass.

Never an error path for the caller: a bad token answers 200 with ok=false, and
the scan endpoint still degrades rather than rejecting, so a client that cannot
verify at all keeps working on the unverified quota.

## Query parameters

- `lang` string

## Headers

- `X-UI-Lang` string

## Request body

- VerifyIn
  - `turnstile_token` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/scanforai/apis/scanforai-api.md) · [All operations](https://skmtc.dev/scanforai/apis/scanforai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanforai/apis/scanforai-api/revisions/ab5d27f4ae13?raw)