get_proof_token
Retrieve the current signed token for a proof you own by its ph_ctl_* handle. Use it after a key rotation to get the re-signed token that replaces older copies.
Instructions
Get the current token of a proof you own, by its public ph_ctl_* handle. After a signing-key rotation this is the re-signed token, which replaces any older copy you hold. Each read is audited. A revoked or expired proof answers proof_not_live; a suspended one is still served. The proof of one of the account's own verified assets (a domain, phone or email verified on the account itself) answers owner_session_required here whatever its status (with a live key; a test key gets not_found): this tool sends the API key, and such a token is read by the signed-in owner in the dashboard. A key bound to a sub-account reads only that sub-account's proofs; another's answers not_found. For a delegation (ph_dlg_*) use get_delegation_token or get_delegation instead.
ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, then call this tool again. start_login does NOT open this tool.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Public proof handle (ph_ctl_<32 hex>) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | The proof token as stored now. After a key rotation it is the re-signed token under a newer `kid`: every claim is kept except `iat`, which is the re-signing time, and a token issued before schema 1.2 also gains the `jti` and `proof_id` its registry row records. | |
| status | Yes | Live statuses only — a revoked or expired proof answers 410 `proof_not_live` instead | |
| proof_id | Yes | Public proof handle (`ph_ctl_<32 hex>`) | |
| expires_at | Yes | ||
| reissued_at | Yes | When the token was last re-signed under a newer key; null if it never was |