# Verify a launch URL

Confirms that the larm_* parameters your launch URL received were issued by LARM for your app just now.

```http
POST https://larm.sa/oauth/launch/verify
```

Send the parameters exactly as received. The URL is valid for 5 minutes, and LARM does not store `larm_nonce`, so reject repeats yourself. See [App launch](/guides/app-launch) for details.

## Request body

| Field | Type | Required | Description |
|---|---|---|---|
| `larm_store_id` | string (uuid) | yes |  |
| `larm_installation_id` | string (uuid) | no |  |
| `larm_intent` | object | yes | One of: `install`, `open`. |
| `larm_issued_at` | string | yes |  |
| `larm_nonce` | string | yes |  |
| `larm_signature` | string | yes |  |


## Response

| Field | Type | Required | Description |
|---|---|---|---|
| `valid` | object | no |  |
| `store_id` | string (uuid) | no |  |
| `installation_id` | string \| null (uuid) | no |  |
| `intent` | object | no | One of: `install`, `open`. |
| `issued_at` | integer | no |  |


## Example request

```bash
curl -X POST "https://larm.sa/oauth/launch/verify" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{ "larm_store_id": "5b1d7a62-0c4e-4f38-9a51-2e7b3c9d8f10", "larm_installation_id": "c7e4a1f2-6b3d-4e8a-9c05-1d2f3a4b5c6d", "larm_intent": "open", "larm_issued_at": "1792060800", "larm_nonce": "Vx3mQ0aT9kLz2pR8sN4wYb1c", "larm_signature": "8m2Kq…" }'
```


## Example response (200)

```json
{
  "valid": true,
  "store_id": "5b1d7a62-0c4e-4f38-9a51-2e7b3c9d8f10",
  "installation_id": "c7e4a1f2-6b3d-4e8a-9c05-1d2f3a4b5c6d",
  "intent": "open",
  "issued_at": 1792060800
}
```


## Errors

| HTTP | Code | Meaning |
|---|---|---|
| 400 | `INVALID_LAUNCH` | Missing or extra keys. |
| 401 | `LAUNCH_EXPIRED` | More than 5 minutes have passed. |
| 401 | `LAUNCH_SIGNATURE_INVALID` | The signature does not match. |
| 401 | `INSTALLATION_INACTIVE` | The installation is not active. |