Token Exchange

Create exchange token

Creates a short-lived (60 s) HMAC-SHA256-signed token. The Base64URL-encoded payload contains: userId, merchantId, accountSlug, iat (issued-at ms), exp (expiry ms), and nonce. Consuming applications that share the signing secret can verify the signature and trust the payload contents.

post/token-exchange

Response

tokenstring required

Short-lived (60 s) HMAC-SHA256-signed exchange token. The Base64URL-encoded payload contains: userId, merchantId, accountSlug, iat, exp, and nonce.

Example response

{
  "token": "eyJ1c2VySWQiOiJ1c3JfMTIzIiwibWVyY2hhbnRJZCI6Im1jaF8xMjMifQ.c2lnbmF0dXJl"
}

Changes

No recorded changes to this endpoint across all 1 revision of this API.