Skip to main content

Verify Token

GET 
/api/me

Confirms your token works, names the account it belongs to, and lists the scopes it carries. Requires no scopes, so it succeeds with any valid token — run it first.

Authorization

Any valid API token can call this endpoint — no specific scope required. Manage tokens.

Check tenant_id. A 200 on its own only proves that some real account answered. Every SKU.io account answers on its own hostname, and an unrecognised hostname still resolves, so a mistyped {{domain}} fails with the same 401 as a bad token. Confirming tenant_id is what catches it.

Check token.scopes. This is exactly what the token may do. Reading it up front beats discovering a missing scope from a 403 partway through a multi-step job, with the earlier steps already committed. token is null when you are authenticated by browser session rather than a token.

If it fails:

  • 401 — the token is missing, wrong, revoked, or expired; or {{domain}} names an account that isn't yours. Set {{domain}} to everything you see before .sku.io when you sign in, keeping any extra labels (beta.acme.sku.io, not acme.sku.io).
  • 404 — the path is wrong. Every API route lives under /api.
  • 403 {"error": "This token can only be used for the account it was created for."} — a Personal Access Token, OAuth app connection or MCP token works only for the account it was created for; an X-Tenant-Id header, ?t= or hostname naming another account is refused. {"error": "You do not have access to this tenant"} means the token's owner has since been removed from that account.

Request​

Responses​

OK

Response Headers
    Content-Type