Mint Order Intake Session

The mint body, {"secret"?: "1234"}: the form's PIN, when it has one.

Deliberately loose: a malformed PIN is the same ORDER_INTAKE_PIN_INVALID as a wrong one, decided by the service after the link resolves as live, never a distinct validation error that could tell a caller about the form. Unknown keys are ignored. Named secret so the request logger redacts it.

The mint response, and the entire browser contract (PLAT-22260).

The host backend forwards this verbatim to its page; it is not expected to add, rename, or reshape anything. Four fields, each earning its place:

• client_secret — the only value that authenticates the browser.
• expires_at — so the page can refresh before a request fails rather than discovering expiry as a broken widget.
• session_id — non-secret. The browser's cache key and the id that shows up in logs and support tickets, which is exactly why it is separate from the secret rather than derived from it.
• api_region — which Nash API the widget bundle should talk to, as one of the published wire tokens the widget loader accepts: "us" or "au". Never a deployment region string like us-west-1 — the browser resolves this against its own build-time endpoint table, not against server config (see embed_session_service.resolve_api_region).