Exchange the token in /creator-partnership/{token} for the form prefill behind it.

The token is an opaque id, so the landing page cannot read it — it has to ask. Same shared static x-api-key gate as the intake routes, since the page calling this has no session. The answer is built fresh on every call, not served from a snapshot taken when the link was minted — current_plan moves the moment the creator joins or upgrades, so a creator who opened the link, joined at Registered and came back would otherwise still be told they held nothing.

404s once the Redis TTL has passed; there is nothing else to expire.

Rate limited because the x-api-key it is gated on ships in the landing page's own source and cannot be a secret. Guessing a token is hopeless either way — 32 random bytes — but the cap costs nothing. Generous enough that a creator reloading the page never trips it.