Skip to navigation
OTP Members

Exchange a login code for a member token

Exchanges the emailed 6-digit code for a member access token (a JWT, valid 30 minutes). Every call spends one of the 5 attempts, right or wrong; a code works once. The token is the shopper’s member identity for the session. Its members claim lists the members behind the email with their memberships — display data only, a snapshot taken at login. It is not accepted by the endpoints that take a POST /oauth/token token. Endpoints that read a member token say so in their own documentation.

Headers

x-entriastringRequired

Identifies which store this request is for. Required on every store-scoped route. It is not authentication and not a secret — it grants no privileges and is safe to send from a browser. You receive the value once your Entria backend has been created and configured. Missing header returns 400; an unknown store returns 404.

Request

This endpoint expects an object.
emailstringRequiredformat: "email"<=320 characters

The shopper’s email address.

codestringRequiredformat: "^\d{6}$"

The 6-digit code from the email.

Response

The member token.
access_tokenstring
token_typeenum
Allowed values:
expires_indouble

Errors

400
Bad Request Error
401
Unauthorized Error
404
Not Found Error
429
Too Many Requests Error
503
Service Unavailable Error