---
title: "Verify & decode an access token"
method: POST
path: "/groups/{groupId}/apps/{appId}/users/verify_token"
tags: ["users"]
---

# Verify & decode an access token

`POST /groups/{groupId}/apps/{appId}/users/verify_token`

Verify a that a user's client access token is valid.

## Request body

- object
  - `token` string, required

## Response `200`

Token is valid or expired.

- union
  - 'token expired' — The token is valid but has expired.
  - object — The token is valid and is not expired.
    - `sub` string — User ID.
    - `aud` string — Specifies which Resource Servers the JWT is valid for. Omitted if empty.
    - `exp` integer — The Unix timestamp when the JWT expires.
    - `iat` integer — The Unix timestamp when the JWT was issued.
    - `iss` string — The issuer of the JWT.
    - `custom_user_data` object — Contains [custom user data](https://www.mongodb.com/docs/atlas/app-services/users/custom-metadata/#custom-user-data) if it exists for the user. Only present if the access token is created after custom user data is enabled and configured. Omitted if empty.
    - `domain_id` string
    - `data` string — Optional: any metadata stored with the token. Omitted if empty.
    - `device_id` string

## Other responses

- `400` — Bad request
- `401` — Invalid Session

---

[API](https://skmtc.net/mongodb/apis/mongodb-atlas-app-services-admin-api.md) · [All operations](https://skmtc.net/mongodb/apis/mongodb-atlas-app-services-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mongodb/mongodb-atlas-app-services-admin-api/versions/1365ab72bc03/schema)