Skip to main content
GET
/
api
/
verify-token
Verify Token
curl --request GET \
  --url https://api.example.com/api/verify-token
{
  "error": "No token provided, authorization denied"
}
This endpoint verifies that a JWT token is valid and returns the authenticated user’s information. Use this to check if a user’s session is still active.

Authentication

Required: This endpoint requires a valid JWT token. Include the token in the request header:
Authorization: Bearer <token>
or
x-auth-token: <token>

Request Example

curl -X GET https://api.meetmates.com/api/verify-token \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
curl -X GET https://api.meetmates.com/api/verify-token \
  -H "x-auth-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Response

success
boolean
Indicates if the token is valid
message
string
Success message confirming token validity
user
object
Authenticated user information

Response Example

200 - Success
{
  "success": true,
  "message": "Token is valid",
  "user": {
    "id": "657f4d8e90c23a4567b38f91",
    "email": "[email protected]",
    "name": "John Doe"
  }
}

Error Responses

error
string
Error message describing what went wrong

Error Codes

{
  "error": "No token provided, authorization denied"
}

Token Authentication Flow

The endpoint performs the following checks:
  1. Token Extraction: Looks for token in Authorization: Bearer <token> header or x-auth-token header
  2. Token Verification: Verifies the JWT signature and expiration using the server’s secret key
  3. User Lookup: Retrieves the user from the database using the ID from the token
  4. Response: Returns user information (excluding password)

Use Cases

  • Session Validation: Check if a stored token is still valid before making authenticated requests
  • User Profile Loading: Retrieve current user information on app startup
  • Token Refresh Logic: Determine when to prompt user for re-authentication
  • Protected Route Guards: Verify authentication before allowing access to protected features

Notes

  • The password field is excluded from the response for security
  • Tokens expire after 7 days from issuance
  • If the user is deleted from the database, their token becomes invalid even if not expired
  • This endpoint does not extend or refresh the token expiration time

Build docs developers (and LLMs) love