billing
billing

Mint Checkout Token

Mint a one-time signed token for /v2/billing/checkout.

B-WEBHOOKS (R3 F2, F6): the token binds (subject, sku, expiry) at issue-time so the webhook credit-grant cannot be redirected by an attacker-controlled checkout body. Subjects are resolved from authenticated state in this order:

  1. Authorization: Bearer <api_key> → subject is the key's hash.
  2. X-API-Key: <api_key> → ditto.
  3. X-Tenant-Id / X-User-Id → subject is the tenant id.
  4. body.email + no headers → subject is the body email, kind="email" — the gift / one-off flow. Webhook will only credit if exactly one active API key matches.
post/v2/billing/checkout_token

Request

  • Base URL: https://api.etymolt.com
  • URL: https://api.etymolt.com/v2/billing/checkout_token
  • Auth: none declared

Headers

X-Tenant-Idstring nullable
X-User-Idstring nullable
Authorizationstring nullable
X-API-Keystring nullable

Request body

skustring
emailstring nullable

Response

Successful Response

tokenstring required
skustring required
expires_atinteger required
subject_kindstring required

Changes

No recorded changes to this operation across all 1 revision of this API.