Skip to navigation
Account

Exchange a login code for an account token

Exchanges the emailed 6-digit code for a member access token (a JWT, valid 30 minutes). Every call spends one of the 5 attempts, right or wrong; a code works once. The token is the shopper’s identity for the session: sub is the proven email, which is the account. Its members claim lists the Business Central members behind the email with their memberships, and is an empty array when there are none (not a member, or Business Central could not be reached at login). It is display data only, a snapshot taken at login: read GET /api/account/me for the current state, and never treat an empty members as an error. It is not accepted by the endpoints that take a POST /oauth/token token. Endpoints that read an account token say so in their own documentation.

Headers

x-entriastringRequired

Identifies which store this request is for. Required on every store-scoped route. It is not authentication and not a secret — it grants no privileges and is safe to send from a browser. You receive the value once your Entria backend has been created and configured. Missing header returns 400; an unknown store returns 404.

Request

This endpoint expects an object.
emailstringRequiredformat: "email"<=320 characters

The shopper’s email address.

codestringRequiredformat: "^\d{6}$"

The 6-digit code from the email.

Response

The account token.
access_tokenstring
token_typeenum
Allowed values:
expires_indouble

Errors

400
Bad Request Error
401
Unauthorized Error
404
Not Found Error
429
Too Many Requests Error
503
Service Unavailable Error