# Need to prove auth status to an api **URL:** \ **Category:** Get Help\ **Tags:** api\ **Created:** [April 27, 2017, 6:16am UTC](https://community.auth0.com/t/need-to-prove-auth-status-to-an-api/6380 "2017-04-27T06:16:09Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![agerson](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/agerson/32/7127_2.png) [@agerson](https://community.auth0.com/u/agerson)\ **Post date:** [April 27, 2017, 6:16am UTC](https://community.auth0.com/t/need-to-prove-auth-status-to-an-api/6380/1 "2017-04-27T06:16:09Z")
I have a custom REST API that takes in user/password and I see how I can use a custom database connection to integrate that into Auth0. I also see the SDK the would allow my mobile app to authenticate users against Auth0. Here is what I need help with. I now want a third system, another REST API, to be sent some kind of token that proves its a logged in user originating in my mobile app. How would I handle that? Is there a way to get a token from the logged in user on my mobile app, pass it to my api and validate it there? ---
**Author:** ![prashantT](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/prashantt/32/6002_2.png) [@prashantT](https://community.auth0.com/u/prashantT)\ **Post date:** [April 27, 2017, 12:12pm UTC](https://community.auth0.com/t/need-to-prove-auth-status-to-an-api/6380/2 "2017-04-27T12:12:59Z")
The [API Authorization](https://auth0.com/docs/api-auth) features can help protect your API through the access token’s issued to a logged in user. For a mobile app, you would be using the Authorization Code (PKCE) flow, outlined here: > **[Authorization Code Flow with Proof Key for Code Exchange (PKCE)](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-proof-key-for-code-exchange-pkce)** > > Learn how the Authorization Code flow with Proof Key for Code Exchange (PKCE) works and why you should use it for native and mobile apps. Note, access\_tokens do not contain a “logged in” state - being JWT’s, they have an `exp` expiry claim after which the token is expired. This expiry can be configured in the API settings in the Auth0 dashboard. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [March 2, 2018, 5:53am UTC](https://community.auth0.com/t/need-to-prove-auth-status-to-an-api/6380/3 "2018-03-02T05:53:31Z")