> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slideless.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /verifyApiKey

> Validate an API key and return its metadata — name, scopes, organization, last-used time

<Note>
  For most use cases, the [`slideless` CLI](/cli/overview) is easier than calling this endpoint directly. The CLI command equivalents are `slideless verify` (exit-code-based pass/fail) and `slideless whoami` (full identity output).
</Note>

## When to use

Test that an API key is valid before making destructive calls. Useful at the start of CI jobs, scripts, or interactive setup flows. The marketplace `setup-slideless` skill uses this endpoint to confirm a freshly-created key works.

The endpoint is intentionally cheap — it touches Firestore once but does no storage or compute work.

## Endpoint

```
POST https://europe-west1-slideless-ai.cloudfunctions.net/verifyApiKey
```

## Auth

| Header          | Value                                           |
| --------------- | ----------------------------------------------- |
| `Authorization` | The key you want to verify (`cko_…` or `cka_…`) |

No request body.

## Response (200)

For an organization key (`cko_`):

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "success": true,
  "data": {
    "type": "org-api-key",
    "keyName": "claude-skill",
    "keyPrefix": "cko_abcd",
    "scopes": ["presentations:write", "presentations:read"],
    "organizationId": "org-uuid",
    "organizationName": "Romain's workspace",
    "createdAt": "2026-04-15T10:00:00.000Z",
    "expiresAt": null,
    "lastUsedAt": "2026-04-19T09:12:00.000Z",
    "requestId": "0192f1c3-..."
  }
}
```

For an admin key (`cka_`), `organizationId` and `organizationName` are `null`; `type` is `"admin-api-key"`.

| Field                                                 | Type                    | Description                                  |
| ----------------------------------------------------- | ----------------------- | -------------------------------------------- |
| `success`                                             | boolean                 | Always `true` on 200                         |
| `data.type`                                           | string                  | `"org-api-key"` or `"admin-api-key"`         |
| `data.keyName`                                        | string \| null          | Human-readable label given at creation       |
| `data.keyPrefix`                                      | string \| null          | First 8 chars (`cko_abcd`) — safe to display |
| `data.scopes`                                         | array of strings        | The scopes attached to this key              |
| `data.organizationId`                                 | string \| null          | The org context (null for admin keys)        |
| `data.organizationName`                               | string \| null          | The org's display name (null for admin keys) |
| `data.createdAt`, `data.expiresAt`, `data.lastUsedAt` | ISO 8601 string \| null | Timestamps                                   |
| `data.requestId`                                      | UUIDv7 string           | Trace ID — include in support requests       |

## Errors

| Status | Code                 | Cause                              | Fix                                                          |
| ------ | -------------------- | ---------------------------------- | ------------------------------------------------------------ |
| `401`  | `unauthenticated`    | Missing, malformed, or revoked key | Send a valid `cko_` or `cka_` value in `Authorization`       |
| `405`  | `method-not-allowed` | Used GET/PUT/etc.                  | Use `POST`                                                   |
| `500`  | `internal`           | Backend error fetching metadata    | Retry; if persistent, include `requestId` in support request |

Error response shape (same envelope as every other CLI-facing endpoint):

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "success": false,
  "error": {
    "code": "unauthenticated",
    "message": "Invalid or missing API key."
  }
}
```

## Examples

### curl

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -sS -X POST \
  -H "Authorization: Bearer $SLIDELESS_API_KEY" \
  https://europe-west1-slideless-ai.cloudfunctions.net/verifyApiKey
```

### Node.js

```js theme={"theme":{"light":"github-light","dark":"github-dark"}}
const res = await fetch(
  'https://europe-west1-slideless-ai.cloudfunctions.net/verifyApiKey',
  {
    method: 'POST',
    headers: { 'Authorization': `Bearer ${process.env.SLIDELESS_API_KEY}` }
  }
);

const body = await res.json();
if (!body.success) {
  throw new Error(`Invalid Slideless key: ${body.error?.message}`);
}
console.log(`Authenticated as ${body.data.organizationName} with scopes: ${body.data.scopes.join(', ')}`);
```

## Operational use

* **At the start of long-running scripts.** Fail fast if the key is wrong before doing any real work.
* **In CI before deploys.** Make sure the secret in your CI vault is still valid.
* **In setup wizards.** The marketplace `setup-slideless` skill calls this immediately after the user pastes the key, so users get instant feedback.