Guides Integration
Verify User Age (via UserInfo)
The id_token only proves that the user authenticated. To get their age status you must call /userinfo with the access_token from the previous step. This is the single source of truth for verification.
GET
https://app.agewallet.io/user/userinfo| Header | Value |
|---|---|
Authorization | Bearer {access_token} |
Request
curl https://app.agewallet.io/user/userinfo \
-H "Authorization: Bearer $ACCESS_TOKEN"async function fetchUserInfo( accessToken ) {
const response = await fetch( 'https://app.agewallet.io/user/userinfo', {
headers: { Authorization: `Bearer ${ accessToken }` }
} );
// A failed request is not the same as an unverified user. Treat 401 as a
// broken integration — an expired or wrong access token — not as "underage".
if ( ! response.ok ) {
throw new Error( `UserInfo request failed: ${ response.status }` );
}
return response.json();
}
const userInfo = await fetchUserInfo( tokens.access_token );
if ( userInfo.age_verified === true ) {
// Grant access, and record your own decision now.
} else {
// Do not grant access.
}$ch = curl_init( 'https://app.agewallet.io/user/userinfo' );
curl_setopt_array( $ch, array(
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 10,
CURLOPT_HTTPHEADER => array( 'Authorization: Bearer ' . $access_token ),
) );
$response = curl_exec( $ch );
$status = curl_getinfo( $ch, CURLINFO_RESPONSE_CODE );
curl_close( $ch );
if ( false === $response || 200 !== $status ) {
// Request failed. Do not treat this as an unverified user.
return;
}
$user_info = json_decode( $response, true );
if ( isset( $user_info['age_verified'] ) && true === $user_info['age_verified'] ) {
// Grant access, and record your own decision now.
} else {
// Do not grant access.
}Response
{
"sub": 89,
"age_verified": true,
"expires_at": 1765035995,
"metadata": "order:XYZ-42"
}
| Field | Type | Notes |
|---|---|---|
sub | integer | Stable identifier for this user. |
age_verified | boolean | The verification result. Compare with strict equality against true. |
expires_at | integer | Unix timestamp. |
metadata | string | Only present when a metadata value was sent on the /authorize request. See Pass-through Metadata. |
When the call fails
| Status | Meaning | What to do |
|---|---|---|
401 | The access token is missing, expired or invalid. | Do not treat this as an unverified user. It is an integration fault — restart the flow at /authorize. |
5xx | Service error. | Do not grant access. Retry once, then fail closed. |
The distinction matters: a user who fails verification and a request that never completed both end in “no access”, but only one of them is a bug in your integration. Logging them identically hides real faults.
For the full set of outcomes — underage, cancelled, exempt regions, failed verification — see Handling Responses and Error Cases.