> ## Documentation Index > Fetch the complete documentation index at: https://docs.aion.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Validate credential > **Port**: 9002 (private) - Internal use only, not exposed publicly. Polymorphic credential validation supporting both JWT tokens and API keys. Called by API gateway to validate incoming requests before proxying. For JWT tokens, validates against Auth0 and returns user information. For API keys, validates the key hash and returns associated user/account info. When validating for write operations (POST, PUT, PATCH, DELETE), unverified users will receive a 403 Forbidden response. ## OpenAPI ````yaml GET /api/v1/auth/validate openapi: 3.1.0 info: title: AION Authentication Service API description: > Authentication and user management service for the AION platform. This service provides: - JWT and API key validation - User profile management - API key lifecycle management - User invitation and team management ## Authentication Most endpoints require authentication via one of: - **Bearer Token (JWT)**: OAuth2/OIDC tokens from Auth0 - **API Key**: Service-generated API keys for machine-to-machine authentication Protected endpoints also require the `x-account-id` header to specify the account context. ## Error Handling All errors follow a consistent format with error codes prefixed by category: - `AUTH_*`: Authentication errors - `USER_*`: User management errors - `ACCT_*`: Account errors - `ROLE_*`: Role/permission errors - `APIKEY_*`: API key errors - `GEN_*`: General errors version: 1.0.0 contact: name: AION Intelligence license: name: Proprietary servers: - url: http://localhost:9001 description: Local development server (Public API) - url: http://localhost:9002 description: Local development server (Private/Health endpoints - internal only) - url: https://api.aion.ai description: Production server (Public API) - url: https://api-internal.aion.ai description: Production server (Private/Health endpoints - internal network only) security: [] tags: - name: Health description: > Service health and status endpoints. **IMPORTANT**: These endpoints are served on a separate private port (9002 by default). They should NOT be exposed publicly and are intended for: - Kubernetes health probes (readiness/liveness) - Internal monitoring systems - Load balancer health checks - name: Authentication description: Authentication and credential validation - name: Webhooks description: Webhook endpoints for external services (Auth0) - name: User Profile description: User profile management - name: Users description: User management and invitations - name: API Keys description: API key lifecycle management paths: /api/v1/auth/validate: get: tags: - Authentication summary: Validate credential (Internal/Gateway) description: > **Port**: 9002 (private) - Internal use only, not exposed publicly. Polymorphic credential validation supporting both JWT tokens and API keys. Called by API gateway to validate incoming requests before proxying. For JWT tokens, validates against Auth0 and returns user information. For API keys, validates the key hash and returns associated user/account info. When validating for write operations (POST, PUT, PATCH, DELETE), unverified users will receive a 403 Forbidden response. operationId: validateCredential parameters: - $ref: '#/components/parameters/UpstreamMethod' responses: '200': description: Credential is valid headers: x-user-id: schema: type: string description: User's external ID x-account-id: schema: type: string description: Account's external ID x-user-verified: schema: type: string description: Whether user email is verified ('true' or 'false') content: application/json: schema: $ref: '#/components/schemas/SuccessResponse' example: success: true data: user_id: user-abc123-v1 account_id: acct-xyz789-v1 scopes: - read - write auth_type: jwt is_verified: true '400': description: Missing authorization token content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: success: false error: code: AUTH_001 type: validation message: Authorization token is required '401': description: Invalid or expired token content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: success: false error: code: AUTH_002 type: unauthorized message: Invalid or expired authentication token '403': description: User not verified (for write operations) content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: success: false error: code: AUTH_008 type: forbidden message: Email verification required for this action security: - bearerAuth: [] - apiKeyAuth: [] servers: - url: http://localhost:9002 description: Private server (internal only) components: parameters: UpstreamMethod: name: x-upstream-method in: header required: false description: > Original HTTP method from upstream request (used by gateway). If method is POST/PUT/PATCH/DELETE and user is unverified, request is rejected. schema: type: string enum: - GET - POST - PUT - PATCH - DELETE schemas: SuccessResponse: type: object properties: success: type: boolean example: true data: type: object ErrorResponse: type: object properties: success: type: boolean example: false error: $ref: '#/components/schemas/AppError' AppError: type: object properties: code: type: string description: Error code (e.g., AUTH_001, USER_002) example: AUTH_002 type: type: string enum: - validation - unauthorized - forbidden - not_found - conflict - internal example: unauthorized message: type: string description: User-friendly error message example: Invalid or expired authentication token details: type: string description: Additional error details (optional) securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: JWT token from Auth0 apiKeyAuth: type: http scheme: bearer description: API key (prefixed with configured prefix, e.g., 'ai_prod.') ````