---
title: "VerifyMySignal — verify a signed signal"
method: POST
path: "/v1/signals/verify"
---

# VerifyMySignal — verify a signed signal

`POST /v1/signals/verify`

## Request

- Base URL: `https://api.scrubmytext.com`
- URL: `https://api.scrubmytext.com/v1/signals/verify`
- Auth: HTTP bearer

Verifies HMAC-SHA256 over timestamp + dot + nonce + dot + message, enforces freshness, and rejects replayed nonces. Message and shared secret are not stored. Production.

## Request body

- object
  - `message` string, required
  - `shared_secret` string, required
  - `signature` string, required
  - `timestamp` integer, required
  - `nonce` string, required
  - `max_age_seconds` integer

## Response `200`

Authenticity, freshness, replay, and acceptance result

## Other responses

- `401`: Paid API key required
- `422`: Invalid input

---

[API](https://skmtc.dev/scrubmytext/apis/scrubmytext-agent-infrastructure-api.md) · [All operations](https://skmtc.dev/scrubmytext/apis/scrubmytext-agent-infrastructure-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scrubmytext/apis/scrubmytext-agent-infrastructure-api/revisions/54ace36baccf?raw)