---
title: "Validate an access key and fetch account context"
method: POST
path: "/api/v1/auth/validate"
tags: ["Auth"]
---

# Validate an access key and fetch account context

`POST /api/v1/auth/validate`

## Request

- Base URL: `https://skillrepo.dev`
- URL: `https://skillrepo.dev/api/v1/auth/validate`
- Auth: HTTP bearer

Validates the bearer token and returns the associated account + key context. Primary caller is `skillrepo init` at CLI setup time; also used by `skillrepo auth validate` to verify a token without performing any other action.

Scope: `none` — any valid key can self-introspect, regardless of its read/write scope set. The rate-limit bucket (`cli-crud`, 60/min) is the abuse gate against key-probing attacks.

## Headers

- `X-SkillRepo-Source` 'init' | 'validate': Caller identification header. `init` is sent by `skillrepo init` so server-side metering can distinguish bootstrap from verify traffic. Missing/unknown values default to the `cli.validate` event type.

## Response `200`

Key is valid.

- AuthValidateResponse: Account + key context returned by `skillrepo init` and `skillrepo auth validate`.
  - `userId` string, required
  - `accountId` string, required
  - `accountSlug` string, required: URL-safe slug for the account (lowercase, hyphenated).
  - `accountName` string, required
  - `scopes` string[], required: Scopes granted to the key. Includes `registry:read` and/or `registry:write`.
  - `keyId` string, required: Opaque identifier for the access key. Used by the Connect usage card to attribute usage back to specific keys.
  - `tier` string, required: Account plan tier (e.g. `free`, `team`). Informational for the CLI — not enforced client-side.

## Other responses

- `401`: Missing or invalid authentication. For routes that require `bearerAccessKey` or `bearerCatalogKey`.
- `403`: Authenticated, but the key lacks the required scope or the account is suspended. Use `code` to distinguish: `insufficient_scope`, `account_suspended`, `plan_limit`.
- `429`: Rate limit exceeded on the route's bucket. Includes `X-RateLimit-*` headers indicating the limit, remaining, and reset time.

---

[API](https://skmtc.dev/skillrepo/apis/skillrepo-api.md) · [All operations](https://skmtc.dev/skillrepo/apis/skillrepo-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skillrepo/apis/skillrepo-api/revisions/b62bac246918?raw)