---
title: "Verify Marketing Access Token"
method: POST
path: "/v1/auth/verify-token"
tags: ["Auth"]
---

# Verify Marketing Access Token

`POST /v1/auth/verify-token`

Verifies and consumes a single-use access token issued by the Meteor `bluehive:login-links` package. Used by the marketing site auth callback to resolve a user from an opaque token.

## Request body

- object
  - `token` string, required — Plaintext single-use access token issued by the Meteor app (bluehive:login-links) for the marketing auth flow.
  - `type` string — Expected token type (e.g. "marketing-auth"). Defaults to "marketing-auth".

## Response `200`

Default Response

- object
  - `valid` boolean, required
  - `reason` string — Reason the token is invalid (only present when valid=false)
  - `user` object
    - `_id` string, required
    - `email` string, required
    - `name` string, required
    - `avatar` string
    - `roles` string[]
  - `loginToken` string — Plaintext Meteor resume login token freshly minted for the user. Only present when valid=true. Callers should store this securely (e.g. HttpOnly cookie) and present it via the `x-login-token` header (with `x-user-id`) on subsequent API requests. The hashed form is also persisted in `services.resume.loginTokens` on the user document so Meteor can validate it as a normal session.
  - `hashedLoginToken` string — SHA-256(base64) of `loginToken`. Convenience for callers that prefer the pre-hashed `x-hashed-login-token` header. Only present when valid=true.
  - `expiresIn` number — Lifetime of the minted `loginToken` in seconds. Only present when valid=true.

## Other responses

- `400` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/bluehive-health/apis/bluehive-api.md) · [All operations](https://skmtc.net/bluehive-health/apis/bluehive-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bluehive-health/bluehive-api/revisions/ae97a9add0ba/schema)