> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getaptly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify a delegate token

> Validates a short-lived delegate token issued by `POST /api/platform/user-token`.
Checks the JWT signature, expiry, and confirms the token was issued for the same
company as the API key. Use this to confirm the identity of an authenticated Aptly
user inside an embedded plugin or iframe.




## OpenAPI

````yaml /openapi.yaml post /api/board/verify-user
openapi: 3.0.3
info:
  title: Aptly API
  version: '1.0'
  description: >
    The Aptly API lets you read and write cards on any Aptly board from external
    systems.


    All requests require an API key passed as the `x-token` header.

    API keys are scoped to your company and work across all boards.
servers:
  - url: https://core-api.getaptly.com
    description: Production
security:
  - ApiKeyHeader: []
paths:
  /api/board/verify-user:
    post:
      tags:
        - Board
      summary: Verify a delegate token
      description: >
        Validates a short-lived delegate token issued by `POST
        /api/platform/user-token`.

        Checks the JWT signature, expiry, and confirms the token was issued for
        the same

        company as the API key. Use this to confirm the identity of an
        authenticated Aptly

        user inside an embedded plugin or iframe.
      operationId: verifyAppUser
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - token
              properties:
                token:
                  type: string
                  description: Delegate token returned by `POST /api/platform/user-token`.
      responses:
        '200':
          description: Token is valid. Returns the user identity.
          content:
            application/json:
              schema:
                type: object
                properties:
                  userId:
                    type: string
                  email:
                    type: string
                    nullable: true
                  firstName:
                    type: string
                    nullable: true
                  lastName:
                    type: string
                    nullable: true
                  companyId:
                    type: string
        '400':
          description: token field is missing.
        '401':
          description: >-
            Invalid or missing API key, or delegate token is
            invalid/expired/wrong company.
      security:
        - ApiKeyHeader: []
components:
  securitySchemes:
    ApiKeyHeader:
      type: apiKey
      in: header
      name: x-token

````