> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sagescreen.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate a JWT token

> Checks whether the provided token is still valid. If the auth
window has expired but the refresh window is still open, returns
`{"valid": false, "refreshable": true}`.

**Public endpoint** — read-only, no side effects.




## OpenAPI

````yaml /openapi/private/specs/wp/auth.yml get /auth/validate
openapi: 3.1.0
info:
  title: SageScreen — Auth Module
  description: >
    Authentication and session management. Handles JWT token lifecycle

    (issue, refresh, validate, revoke) and WordPress-based login/logout

    with reCAPTCHA/Turnstile protection.


    Uses RS256-signed JWTs stored in the `wp_sage_screen_jwt` table.

    Tokens have a configurable TTL (`sage_screen_jwt_expires`, default 3600 s)

    and a separate refresh window (`sage_screen_jwt_refresh_expires`, default
    604800 s / 7 days).
  version: 1.0.0
servers:
  - url: https://{domain}/wp-json/sagescreen/v1
    description: WordPress REST API
    variables:
      domain:
        default: api.sagescreen.app
security: []
tags:
  - name: Auth – REST
    description: JWT token endpoints (REST API)
  - name: Auth – AJAX
    description: Session-based login / logout / password flows (AJAX)
paths:
  /auth/validate:
    get:
      tags:
        - Auth – REST
      summary: Validate a JWT token
      description: |
        Checks whether the provided token is still valid. If the auth
        window has expired but the refresh window is still open, returns
        `{"valid": false, "refreshable": true}`.

        **Public endpoint** — read-only, no side effects.
      operationId: authValidateToken
      parameters:
        - name: Authorization
          in: header
          required: true
          schema:
            type: string
            examples:
              - Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
          description: Bearer {token}
      responses:
        '200':
          description: Validation result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidateTokenResponse'
              examples:
                valid:
                  summary: Token is valid
                  value:
                    valid: true
                expired:
                  summary: Token expired but refreshable
                  value:
                    valid: false
                    refreshable: true
        '401':
          description: Token missing, invalid, or fully expired
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WPError'
              examples:
                missingToken:
                  summary: No Authorization header
                  value:
                    code: missing_token
                    message: Authorization header with Bearer token required
                    data:
                      status: 401
                notFound:
                  summary: Token not in DB or both windows expired
                  value:
                    code: invalid_token
                    message: Token not found or expired
                    data:
                      status: 401
                malformed:
                  summary: Token cannot be decoded
                  value:
                    code: invalid_token
                    message: Invalid token
                    data:
                      status: 401
      security: []
components:
  schemas:
    ValidateTokenResponse:
      type: object
      required:
        - valid
      properties:
        valid:
          type: boolean
          description: Whether the auth token is currently valid
          examples:
            - true
        refreshable:
          type: boolean
          description: >-
            Present and `true` when the auth token is expired but the refresh
            window is still open
          examples:
            - true
    WPError:
      type: object
      description: Standard WordPress REST API error envelope
      required:
        - code
        - message
        - data
      properties:
        code:
          type: string
          description: Machine-readable error code
          examples:
            - missing_credentials
        message:
          type: string
          description: Human-readable error message
          examples:
            - Username and password are required
        data:
          type: object
          required:
            - status
          properties:
            status:
              type: integer
              description: HTTP status code
              examples:
                - 400

````