PApaywithlocus
End users

Mint an end-user token

Mint server-side only. Creates the tenant-scoped end-user record and credit account on first use. JWT claims are sub, tid, iss=locus-credits, aud=locus-credits-enduser, iat, exp, jti, and optional sid. The sid claim is a SHA-256 fingerprint, not the raw session value. Verification allows 30 seconds of clock skew. There is no refresh token; re-authenticate the user and mint a replacement. A sid-bound token requires the original value in X-Locus-Session-Id whenever used.

post/credits/end-users/{externalUserId}/token

Request

  • Base URL
    https://api.paywithlocus.com/api
  • URL
    https://api.paywithlocus.com/api/credits/end-users/{externalUserId}/token
  • Auth
    • HTTP bearer
    • or HTTP bearer

Path parameters

externalUserIdstring required

Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.

Request body

expiresIninteger
sessionIdstring

High-entropy binding value. The JWT stores only its SHA-256 fingerprint; send the raw value as X-Locus-Session-Id.

Response

Token

successunknown required
tokenstring required
expiresAtstring date-time required
expiresIninteger required
tokenIdstring uuid required
externalUserIdstring required

Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.

Changes

No recorded changes to this operation across all 1 revision of this API.