---
title: "Authorize token for resource access"
method: POST
path: "/tokens/authorize"
tags: ["Tokens"]
---

# Authorize token for resource access

`POST /tokens/authorize`

Verify a token header and validate it against a requested access scope.

## Request body

- AuthorizeTokenRequest
  - `access` MainTokenAccess
    - `action` 1 | 2 | 4 | 8 | 16 | 31 | 0
    - `app_feature` string — AppFeature is a named set of functionality associated with the app. If this is specified, the AppName field must be set. - images: images in the fly.io registry
    - `app_name` string — AppName is the name of the app being accessed.
    - `command` string[] — Command is the command being executed on a machine. If this is specified, the Machine must be set.
    - `machine_feature` string — MachineFeature is a named set of functionality associated with the machine. If this is specified, the Machine field must be set. - metadata: machine metadata service - oidc: OIDC tokens - kmstoken: Petsem tokens for KMS access
    - `machine_id` string — MachineID is the ID of the machine being accessed (e.g. 7811701f564258).
    - `mutation` string — Mutation is the GraphQL mutation being performed.
    - `org_feature` string — OrgFeature is a named set of functionality associated with the organization. If this is specified, the OrgSlug field must be set. - wg: WireGuard peers - builder: remote builders - addon: addons - membership: organization membership - billing: billing - litefs-cloud: LiteFS Cloud - authentication: authentication settings
    - `org_slug` string — OrgSlug is the slug of the organization being accessed.
    - `source_machine` string — SourceMachine is the machine ID of the actor attempting access.
    - `storage_object` string — StorageObject is the storage object being accessed. If this is specified, the OrgSlug must be set.
    - `volume_id` string — VolumeID is the encoded ID of the volume being accessed (e.g. vol_r1p6pln1k9m9j7zr).
  - `header` string

## Response `200`

OK

- AuthorizeResponse
  - `access` FlyioAccess
    - `action` 1 | 2 | 4 | 8 | 16 | 31 | 0
    - `app_feature` string
    - `appid` integer
    - `cluster` string
    - `command` string[]
    - `feature` string
    - `machine` string
    - `machine_feature` string
    - `mutation` string
    - `orgid` integer
    - `sourceApp` string
    - `sourceMachine` string
    - `sourceOrganization` string
    - `storage_object` string
    - `volume` string
  - `verified_token` RootVerifiedToken
    - `caveats` MacaroonCaveatSet
      - `caveats` object[]
    - `header` string
    - `nonce` MacaroonNonce
      - `kid` integer[]
      - `proof` boolean
      - `rnd` integer[]
    - `permission_token` integer[]

## Other responses

- `400` — Bad Request
- `500` — Internal Server Error

---

[API](https://skmtc.net/machines/apis/machines-api.md) · [All operations](https://skmtc.net/machines/apis/machines-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/machines/machines-api/versions/633ddedda749/schema)