Develop

User Verification

Updated: Oct 21, 2026
This is a Platform SDK feature requiring Data Use Checkup
To use this feature, you must complete a Data Use Checkup (DUC). The DUC ensures that you comply with Developer Policies. It requires an administrator from your team to certify that your use of user data aligns with platform guidelines. During development, a DUC you submit is approved automatically and gives your app provisional access. Submitting the app for review or enabling higher release channel limits permanently ends automatic approval, but features you already have keep working while their review runs (see When to submit a DUC). Test users can call these features before DUC approval, except getting the logged-in user, which needs the User ID or User Profile grant.
User Verification needs the User ID feature from Data Use Checkup. Without it, the user ID your app reads comes back as 0 (or the call fails on some devices), and so does the org_scoped_id your server reads.
User Verification validates the identity of each user accessing your application.
In addition to the basic Entitlement Check, this feature uses a client-provided nonce that is used by your trusted server to verify that the Meta account provided by the client is valid for the user providing it. This user verification does not replace the Entitlement Check.
Sequence diagram of user verification between Client Application, Oculus Platform SDK, Your Server, and Oculus Server: the client calls ovr_User_GetUserProof(), gets a nonce, passes it to your server, which verifies it with the Oculus server and returns the result
Your application will call ovr_User_GetUserProof() to retrieve the nonce. After passing the nonce to your server, make an S2S call to verify that the user is who they claim to be.

Integrate User Verification

User Verification requires minimal integration. The only function you need to call is the one that retrieves the nonce. The end-to-end flow for User Verification can be found in the diagram above.
Generate nonce:
ovr_User_GetUserProof()
Details about this function can be found in the Platform SDK Reference Content.
Validate nonce (POST):
The next step requires you to send an S2S API request. See the Server-to-Server API Basics page for information about interacting with our APIs.
You will send a POST request that contains a nonce and a Meta account to the https://graph.oculus.com/user_nonce_validate endpoint to verify that the Meta account from the client is valid. See the Overview page for more information on retrieving the Meta account.
curl -d "access_token=OC|$APP_ID|$APP_SECRET" -d "nonce=$NONCE" -d "user_id=$USER_ID" https://graph.oculus.com/user_nonce_validate
The request returns a verification of the nonce. For example:
{"is_valid":true}

Retrieve a Verified Org Scoped ID

Once you’ve used GetUserProof() and the S2S API to verify the Meta account from the client is valid, you can then send a GET request specifying the User ID to retrieve an Org Scoped ID.
curl -d "access_token=OC|$APP_ID|$APP_SECRET" -d "fields=org_scoped_id" -G https://graph.oculus.com/$USER_ID
The request returns a verified Org Scoped ID:
{"org_scoped_id":"ID"}
Meta
English (US)
© 2026 Meta