Verify the code
Checks the code the user entered and, on success, connects the user and returns the token pair to store. Completing the code is the authorization — there is no separate approval screen.
The returned access_token is the user’s connection token: it acts on behalf of this user (send it as the bearer token to the MCP server to create cards, check balances, and shop as them). It is not the platform token — the endpoints in this reference keep using your platform access token and name the user with user_id.
A code can be verified once: a second verify of the same attempt returns invalid_connect_attempt.
In sandbox the code is always 111111.
access_token returned here is the user’s connection token — it acts
on behalf of this user. Send it as the bearer token to the
MCP server to create cards, check balances, and
shop as them. It is not the platform token you send to the endpoints in
this reference — those keep using your
platform access token and name
the user with user_id.Authorizations
A platform access token. Get one on the Create an access token endpoint by exchanging your client_id + client_secret, then send it as Authorization: Bearer <token>. Tokens live one hour.
Body
Response
The connection. Store the token pair and user.id — every KYC call names the user by it.
connection The user's connection token — store it to act on their behalf. Send it as the bearer token to the MCP server; never in the Authorization header of these endpoints.
Use it with /connect/refresh to get a new pair before the access token expires.
Bearer Seconds until the access token expires (3600 = one hour).
The connected user. Store id — every KYC call names the user by it.