A kiosk
A kiosk is unattended, so it holds a device JWT rather than a person's credential, and it is physically exposed, so it gets the narrowest ceiling on the platform: sell, print, and never hold a customer session.
A kiosk in the lobby sells and prints with nobody standing at it. There is no named human, so a person's credential is wrong; there is a machine, so a device credential is right. It is also physically exposed, which argues for the narrowest ceiling of any caller.
The credential. A device JWT (high trust) obtained by pairing the
kiosk through the devices API. It names the
organisation but not a channel, so every selling request carries
X-Ticketlayer-Channel: <kiosk slug>. A kiosk that is simply a browser
uses the low-trust surface under a publishable key instead, as a
buyer on your website would. A customer
token, if a buyer signs in on the screen, is short-lived and never kept.
The four moments#
| Moment | What happens | Credential |
|---|---|---|
| List what is on sale | GET /events with the kiosk channel in the header. | device JWT plus X-Ticketlayer-Channel |
| Make an order | POST /cart with the channel header, items, POST /cart/{id}/checkout. Cash and card are the terminal's business, driven through Stagehand under its Local Control Token; then POST /orders/{id}/payments. | device JWT plus X-Ticketlayer-Channel |
| Authenticate a customer | A magic link on the screen, or not at all. A kiosk never holds a long-lived customer session. | device JWT; a customer token only for the one transaction |
| Read the order back | Print it: POST /orders/{id}/passes/{passId}/print. A kiosk has no business listing anyone's orders. | device JWT |
The narrowest ceiling#
- Pairing is the credential's whole life. A staff member claims and confirms the pairing, the device receives its credential, and a revoked device stops at the next request. The kiosk never holds a password, a staff token or an organisation API key.
- The channel header is required, not optional. The device's selling
permissions are held at channel scope, so a request without
X-Ticketlayer-Channelis a400and one naming a channel the device has no access to is a403. A kiosk cannot fall through to the organisation-wide view of events. - No customer session outlives the sale. A buyer who signs in by magic link on the screen gets their order printed; the customer token is not kept, and there is no account page.
- The hardware is Stagehand's. The printer, the cash drawer and the payment terminal are peripherals of a paired relay on the same LAN, reached over its local HTTPS server under a Local Control Token. That token drives hardware; it reaches nothing on the API.
The scanning side of the same devices model - manifests, scan operations, redemptions - is under Set up a box office.