use /verify endpoint instead