Operation
Exchange identity proof for customer token
POST
/sales/customer-tokensExchange an identity proof (magic-link code or partner assertion) for a short-lived customer token bound to this channel. Identity is exchanged, never asserted. A sign-in link token redeems on its own. A 6-digit code must name the email or phone it was sent to, and is checked against the newest code for it: a code allows 5 guesses and is then burned, and a contact allows 20 guesses an hour across its codes. Every failed code answers the same 401 INVALID_AUTH_CODE. A partner assertion must be signed with the channel's partnerIdentity key and carry iss, aud (this channel's id), iat (at most five minutes old), a jti not exchanged before, and email; sub, when present, is the partner's own id for the buyer and is matched before the email.
Body
proof*object | object
Returns
Customer token issued successfully
Errors
- 400
- Bad Request - Invalid input
- 401
- Unauthorized - Authentication required
- 403
- Forbidden - Insufficient permissions
- 404
- Not Found - Resource not found
- 500
- Internal Server Error
Every error names its code and links to it. All error codes
curl -X POST "https://live.ticketlayer.com/sales/customer-tokens" \ -H "Authorization: Bearer tlpk_..." \ -H "Content-Type: application/json" \ -d '{ "proof": { "type": "partner_assertion", "code": "string", "email": "string", "phone": "string", "assertion": "string" } }'Response 200
{
"customerToken": "eyJhbGciOiJIUzI1NiIs...",
"expiresIn": 1800,
"customer": {
"id": "string",
"email": "string",
"firstName": "string",
"lastName": "string"
}
}