Skip to content

Verify an Admin UI setup token.

POST
/api/admin/setup-token/verify
Code sample: Shell / cURL
curl --request POST \
--url https://auth.example.com/api/admin/setup-token/verify \
--header 'Content-Type: application/json' \
--data '{ "token": "setup_token_123" }'

Checks whether a setup token is pending and unexpired and returns the associated admin user identity.

Media type application/json
object
token
required
string
Example
{
"token": "setup_token_123"
}

Successful JSON response.

Media type application/json
object
valid
required
boolean
user
required
object
id
required
string
email
required
string format: email
name
string | null
Example
{
"valid": true,
"user": {
"id": "admin_user_123",
"email": "[email protected]",
"name": "Admin User"
}
}

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
"error": "example",
"error_description": "example",
"message": "example",
"webauthn_signal": {
"unknown_credential": true
}
}

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
"error": "example",
"error_description": "example",
"message": "example",
"webauthn_signal": {
"unknown_credential": true
}
}

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
"error": "example",
"error_description": "example",
"message": "example",
"webauthn_signal": {
"unknown_credential": true
}
}