Auth — SSO
Check SSO Token
Checks the status of an SSO token created by sso_create. Poll this endpoint until the status is active (authorized) or expired. When active, the response includes the user's account data and a standard session token.
POST
/api/vaneltonid/sso_check.php
Requires
Authorization: AppID:AppKey header — WebKey not accepted
Request body
| Field | Type | Required | Description |
|---|---|---|---|
| sso_token | string | required | The token returned by sso_create.php |
Test this endpoint
Headers
Body
Responses
{
"status": "active",
"user": {
"id": 42,
"userKey": "abc123...",
"username": "vanelton",
"name": "Vanelton",
"email": "usuario@email.com",
"profileimg": "https://cdn.vaneltonmedia.com/...",
"idverify": 1,
"coins": 150,
"vip_plan": "gold",
"vip_signed": "2025-01-10 12:00:00",
"vip_end": "2026-01-10 12:00:00",
"token": "SESSION_TOKEN_64_CHARS"
}
}{ "status": "pending" }{ "status": "expired" }Status codes
| Status | Meaning | Action |
|---|---|---|
pending | User has not yet authorized | Wait 3 seconds and poll again |
active | User authorized — session token available | Save user.token and proceed |
expired | 10 minutes elapsed without authorization | Create a new SSO token via sso_create |
session_expired | Token was authorized but session is older than 6 days | Create a new SSO token |
User object fields
| Field | Type | Description |
|---|---|---|
| id | int | Numeric account ID |
| userKey | string | Unique user identifier string |
| username | string | Display name |
| name | string | Full name |
| string | Account email | |
| profileimg | string | Avatar URL |
| idverify | int | 1 if account is verified |
| coins | int | Vanelton Coins balance |
| vip_plan | string | Active VIP plan name (or null) |
| token | string | Session token — use in Authorization header or JSON body for all user-scoped API calls. Identical to a token from login.php. |
Errors
| Code | Cause |
|---|---|
| 401 | Invalid AppID:AppKey credentials |
| 400 | sso_token missing or not recognized |