---
title: "Mint Checkout Token"
method: POST
path: "/v2/billing/checkout_token"
tags: ["billing", "billing"]
---

# Mint Checkout Token

`POST /v2/billing/checkout_token`

## Request

- Base URL: `https://api.etymolt.com`
- URL: `https://api.etymolt.com/v2/billing/checkout_token`
- Auth: none declared

Mint a one-time signed token for /v2/billing/checkout.

B-WEBHOOKS (R3 F2, F6): the token binds (subject, sku, expiry) at
issue-time so the webhook credit-grant cannot be redirected by an
attacker-controlled checkout body. Subjects are resolved from
authenticated state in this order:

  1. Authorization: Bearer <api_key>  → subject is the key's hash.
  2. X-API-Key: <api_key>             → ditto.
  3. X-Tenant-Id / X-User-Id          → subject is the tenant id.
  4. body.email + no headers          → subject is the body email,
                                        kind="email" — the gift /
                                        one-off flow. Webhook will
                                        only credit if exactly one
                                        active API key matches.

## Headers

- `X-Tenant-Id` string, nullable
- `X-User-Id` string, nullable
- `Authorization` string, nullable
- `X-API-Key` string, nullable

## Request body

- CheckoutTokenRequest: Mint a one-time signed token for the anonymous-friendly topup flow. B-WEBHOOKS (R3 F2, F6): tokens are issued by an authenticated path so that the (subject, sku) binding is server-trusted. The webhook decodes the token and credits the bound subject — nothing in the Stripe Checkout request body can override it.
  - `sku` string
  - `email` string, nullable

## Response `200`

Successful Response

- CheckoutTokenResponse
  - `token` string, required
  - `sku` string, required
  - `expires_at` integer, required
  - `subject_kind` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names.md) · [All operations](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names/llms.txt) · [OpenAPI document](https://skmtc.dev/etymolt/apis/etymolt-verify-ai-generated-brand-names/revisions/7228ffa1efa7?raw)