Develop

User Verification

Updated: Oct 14, 2026
This is a Platform SDK feature requiring Data Use Checkup
To use this feature, you must complete a Data Use Checkup (DUC). The DUC ensures that you comply with Developer Policies. It requires an administrator from your team to certify that your use of user data aligns with platform guidelines. During development, a DUC you submit is approved automatically and gives your app provisional access. Submitting the app for review or enabling higher release channel limits permanently ends automatic approval, but features you already have keep working while their review runs (see When to submit a DUC). Test users can call these features before DUC approval, except getting the logged-in user, which needs the User ID or User Profile grant.
User Verification validates the identity of each user accessing your application.
In addition to the basic Entitlement Check, this feature uses a client-provided nonce that is used by your trusted server to verify that the Meta account provided by the client is valid for the user providing it. This user verification does not replace the Entitlement Check.
Your application will call Platform.Users.GetUserProof() to retrieve the nonce. After passing the nonce to your server, make an S2S call to verify that the user is who they claim to be.

Integrate User Verification

User Verification requires minimal integration. The only function you need to call is the one that retrieves the nonce. The end-to-end flow for User Verification can be found in the diagram above.
Generate nonce:
Platform.Users.GetUserProof()
Details about this function can be found in the Platform SDK Reference Content.
Validate nonce (POST):
The next step requires you to send an S2S API request. See the Server-to-Server API Basics page for information about interacting with our APIs.
You will send a POST request that contains a nonce and a Meta account to the https://graph.oculus.com/user_nonce_validate endpoint to verify that the Meta account from the client is valid. See the Overview page for more information on retrieving the Meta Quest account.
curl -d "access_token=OC|$APP_ID|$APP_SECRET" -d "nonce=$NONCE" -d "user_id=$USER_ID" https://graph.oculus.com/user_nonce_validate
The request returns a verification of the nonce. For example:
{"is_valid":true}

Retrieve a Verified Org Scoped ID

Once you’ve used GetUserProof() and the S2S API to verify the Meta Quest account from the client is valid, you can then send a GET request specifying the User ID to retrieve an Org Scoped ID.
curl -d "access_token=OC|$APP_ID|$APP_SECRET" -d "fields=org_scoped_id" -G https://graph.oculus.com/$USER_ID
The request returns a verified Org Scoped ID:
{"org_scoped_id":"ID"}
Meta
English (US)
© 2026 Meta