---
title: "Verify password for a password-protected share and return an access token."
method: POST
path: "/api/v1/shares/public/{id}/verify"
tags: ["Shares", "internal"]
---

# Verify password for a password-protected share and return an access token.

`POST /api/v1/shares/public/{id}/verify`

The returned token is an HS256 JWT tied to the share's current password
hash; subsequent `/topology` calls send the token instead of the raw
password. Changing the share password invalidates outstanding tokens.

## Path parameters

- `id` string, uuid, required

## Response `200`

Password verified; access token issued

- ApiResponseShareAccessTokenResponse
  - `data` object — Access token returned after successful password verification. The token is an HS256 JWT tied to the share's `password_hash` — changing the share password implicitly invalidates all outstanding tokens.
    - `access_token` string, required — Bearer token granting access to this share for the rest of the session.
    - `expires_at` string, date-time, required — When this record stops being valid.
  - `error` string, nullable — Human-readable failure message. Omitted on success.
  - `meta` ApiMeta, required — API metadata included in all responses
    - `api_version` integer, required — API version (integer, increments on breaking changes)
    - `server_version` string, required — Server version (semver)
  - `success` boolean, required — `true` when the request succeeded. `false` responses carry `error` instead of `data`.

## Other responses

- `401` — Invalid password
- `404` — Share not found

---

[API](https://skmtc.net/scanopy/apis/scanopy-api.md) · [All operations](https://skmtc.net/scanopy/apis/scanopy-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scanopy/scanopy-api/revisions/2df1fc47dfa7/schema)