curl --request POST \
--url https://api.useselo.xyz/v1/authorizations/{authorizationId}/verifyconst options = {method: 'POST'};
fetch('https://api.useselo.xyz/v1/authorizations/{authorizationId}/verify', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.useselo.xyz/v1/authorizations/{authorizationId}/verify"
response = requests.post(url)
print(response.text){
"authorizationId": "auth_…",
"status": "VERIFIED",
"origin": "https://api.example.com",
"routePath": "/v1/orders",
"method": "POST",
"type": "well_known_file",
"verifiedAt": "2026-10-26T12:00:00.000Z",
"expiresAt": "2026-10-27T12:00:00.000Z"
}Verify an authorization
Selo fetches <origin>/.well-known/selo-verification.txt with GET (10 second timeout, at most 4096 bytes, redirects followed only within the same origin, at most 3) and looks for a line equal to expectedContent. On success the authorization becomes VERIFIED for 24 hours. Calling it again on a verified authorization returns it unchanged without fetching. No request body.
curl --request POST \
--url https://api.useselo.xyz/v1/authorizations/{authorizationId}/verifyconst options = {method: 'POST'};
fetch('https://api.useselo.xyz/v1/authorizations/{authorizationId}/verify', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.useselo.xyz/v1/authorizations/{authorizationId}/verify"
response = requests.post(url)
print(response.text){
"authorizationId": "auth_…",
"status": "VERIFIED",
"origin": "https://api.example.com",
"routePath": "/v1/orders",
"method": "POST",
"type": "well_known_file",
"verifiedAt": "2026-10-26T12:00:00.000Z",
"expiresAt": "2026-10-27T12:00:00.000Z"
}Path Parameters
Authorization ID returned by POST /v1/authorizations. A value that is not a well-formed ID returns 404.
^auth_[0-9A-HJKMNP-TV-Z]{26}$Response
The authorization is verified.
Current state of an authorization. Reading it moves a lapsed PENDING or VERIFIED authorization to EXPIRED.
auth_ plus 26 Crockford base32 characters.
PENDING: challenge issued, not yet verified. VERIFIED: Selo found the token and may test the target until expiresAt. EXPIRED: the challenge or the authorization lapsed. REVOKED: the authorization was withdrawn.
PENDING, VERIFIED, EXPIRED, REVOKED HTTP method Selo uses to call the target.
GET, POST well_known_file: verified through /.well-known/selo-verification.txt on the target origin. manual_owner_consent: an explicit consent recorded by the Selo operator.
well_known_file, manual_owner_consent When Selo verified the token, or null while pending.
While PENDING, when the challenge closes (one hour after creation). Once VERIFIED, when the authorization lapses (24 hours after verification).