Guides Integration

Verify User Age (via UserInfo)

The id_token only proves that the user authenticated. To get their age status you must call /userinfo with the access_token from the previous step. This is the single source of truth for verification.

GEThttps://app.agewallet.io/user/userinfo
HeaderValue
AuthorizationBearer {access_token}

Request

Response

{
  "sub": 89,
  "age_verified": true,
  "expires_at": 1765035995,
  "metadata": "order:XYZ-42"
}
FieldTypeNotes
subintegerStable identifier for this user.
age_verifiedbooleanThe verification result. Compare with strict equality against true.
expires_atintegerUnix timestamp.
metadatastringOnly present when a metadata value was sent on the /authorize request. See Pass-through Metadata.

When the call fails

StatusMeaningWhat to do
401The access token is missing, expired or invalid.Do not treat this as an unverified user. It is an integration fault — restart the flow at /authorize.
5xxService error.Do not grant access. Retry once, then fail closed.

The distinction matters: a user who fails verification and a request that never completed both end in “no access”, but only one of them is a bug in your integration. Logging them identically hides real faults.

For the full set of outcomes — underage, cancelled, exempt regions, failed verification — see Handling Responses and Error Cases.

Last updated July 28, 2026

Was this page helpful?