Note: I have not tried this solution myself, but think it should work.
Some concepts about one time login URL
- You cannot just visit the URL (or even request it via a service, or any other request like curl or wget) to check if it is valid. As the name it is for one time use only.
- It is valid for 24 hours from time it is generated.
These couple of things need to be taken into consideration while validating the login URL.
The URL where the check (and login) of a user happens is
user/reset/%/%/%, where the dynamic arguments are in order : user id, timestamp of the one time login url creation, and the hash of the password.
To implement your solution, I suggest you to create a custom service endpoint and implement the logic which is implemented in user_pass_reset.
You can just skip the part where the function actually logs the user in.