Skip to main content
POST
Verify the code
The access_token returned here is the user’s connection token — it acts on behalf of this user. Send it as the bearer token to the MCP server to create cards, check balances, and shop as them. It is not the platform token you send to the endpoints in this reference — those keep using your platform access token and name the user with user_id.

Authorizations

Authorization
string
header
required

A platform access token. Get one on the Create an access token endpoint by exchanging your client_id + client_secret, then send it as Authorization: Bearer <token>. Tokens live one hour.

Body

application/json
connect_id
string
required

The id returned by /connect/start.

code
string
required

The one-time code the user entered. Always 111111 in sandbox.

Maximum string length: 12

Response

The connection. Store the token pair and user.id — every KYC call names the user by it.

object
enum<string>
Available options:
connection
access_token
string

The user's connection token — store it to act on their behalf. Send it as the bearer token to the MCP server; never in the Authorization header of these endpoints.

refresh_token
string

Use it with /connect/refresh to get a new pair before the access token expires.

token_type
enum<string>
Available options:
Bearer
expires_in
integer

Seconds until the access token expires (3600 = one hour).

user
object

The connected user. Store id — every KYC call names the user by it.