> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tappify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# verifyTappifyToken

> Verifies an install token against Tappify's signing keys and returns its claims.

```ts theme={null}
function verifyTappifyToken(token, options): Promise<TappifyClaims>;
```

Verifies an install token against Tappify's signing keys and returns its
claims.

## Parameters

### token

`string`

### options

[`VerifyTokenOptions`](/extensions/reference/server-api/Interface.VerifyTokenOptions)

## Returns

`Promise`\<[`TappifyClaims`](/extensions/reference/server-api/Interface.TappifyClaims)>

## Remarks

Checks the RS256 signature, the expiry with 60 seconds of clock tolerance, and
that the audience is `ext:<extensionId>`. Rejects with a `TapError` carrying
`TAP_TOKEN_INVALID` when the signature, the expiry or a required claim is wrong,
and `TAP_TOKEN_AUDIENCE` when the token was issued for another extension. A
remote key set is fetched once per url and cached for the process, so calling
this per request costs nothing after the first. `createTappifyHandler` already
verifies every route but health, so call this only outside the handler, or
where you accept a Tappify token on a route of your own.

## Example

```ts theme={null}
import { verifyTappifyToken } from '@tappify/extension-sdk/server';

async function whoCalled(request: Request): Promise<string> {
  const token = (request.headers.get('authorization') ?? '').replace('Bearer ', '');
  const claims = await verifyTappifyToken(token, { extensionId: 'starter' });
  return claims.installId;
}
```