---
title: "Validate session"
method: POST
path: "/sessions/validate"
tags: ["sessions"]
---

# Validate session

`POST /sessions/validate`

Validate a session for a given access token. This will ensure both that the token signature is valid and that the token has not been revoked.

## Request body

- object
  - `accessToken` string, required — The access token to be validated.
  - `clientIds` string[] — A list of IDs of the app clients for which the access token is valid. If provided, the access token must be issued for one of these clients.

## Response `200`

OK

- object
  - `user` object, required — A JSON object containing user claims.
  - `expiresAt` number, required — The token expiry as a Unix timestamp in seconds.
  - `verificationMethod` 'SMS' | 'AUTHENTICATOR_APP' | 'EMAIL_MAGIC_LINK' | 'EMAIL_OTP' | 'PUSH' | 'DEVICE' | 'SECURITY_KEY' | 'PASSKEY' | 'VERIFF' | 'IPROOV' | 'PALM_BIOMETRICS_RR' | 'IDVERSE'

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized

---

[API](https://skmtc.net/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.net/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/versions/5604d744e3ad/schema)