Called by the SDK (reconcile(linkToken:)) to finish a guest-to-account move with a link token your server signed. Authenticated with the publishable key.

The token is single use. It is spent when presented, even if the reconcile is refused. A 429 does not spend it. Limits: the project reconcile limits (300 a minute and 50,000 a day, counted apart from the secret-key endpoint), and 5 presentations an hour for the same from id. That per-id limit fails closed: if the rate-limit store is unavailable the call returns 429 with Retry-After: 5.

A merge sends an identity.reconciled webhook with actor of link_token.

{
  "reconciliation_id": 4821,
  "from": "3f1c9c52-8f5e-4a52-9d9c-0f0b6f1a7c11",
  "into": "user_8472",
  "moved": {
    "transactions": 2,
    "entitlements": 1
  }
}