PUT /session/token?pkat={pkat}

The Token Resend API consumes a Proof Key for Action Token (PKAT) that corresponds to an existing action token. When this API is called or invoked, Storefront Gateway resends the same token (with an updated value) to the specified contact channel (email or mobile). This API is useful when an anonymous user doesn’t receive an expected verification email or SMS, or they deleted that message and need to request a resend. As a best practice, include a Resend option on your client application UI when implementing flows that instruct the user to Check your email, or Check your SMS.

API URL

PUT https://{your.tenant.url}/session/token?pkat={**PKAT**}

This API does not accept a body payload. The client must call this API with the PKAT in the request URL path.

Request Parameter

`pkat`	Proof Key for Action Token. When a client completes a Process that issues an action token to the user, Storefront Gateway also sends a PKAT back to the client application. The PKAT corresponds to that specific action token, and is required for OTP verification. The pkat is a security measure to to prevent brute force attacks on applications that use short-form OTP verification.However, if the client wants to present a Resend Code or Resend Link option on the client application UI after a Process completes, it can use the PKAT in the Token Resend API.
Note: The Token Resend API is functionally similar to the Send Verification Process. However, there are a few key differences:

The Send Verification Process issues a new action token and sends it to the user (and sends a new PKAT to the client).The Token Resend API resends an updated token. In other words, the Send Verification Process sends a new code that they need to enter into the UI, whereas Token Resend API simply resends the same code. Note: From the user’s perspective, this is only significant if your notifications settings are such that you’re sending OTPs to the user, either with — or instead of — verification links.
The Send Verification Process is invoked from an authenticated state meaning that the user is signed in. The Token Resend Process is invoked anonymously.
The Send Verification Process needs and consumes the relevant email address or mobile number and sends the new to this address. It accepts the target authN ID in the request URL, or in the request body. Conversely, the Token Resend API requires current token’s corresponding PKAT, and only accepts the PKAT in the request URL.
The Send Verification Process is invoked by the Process Start API.

Parent topic:Process APIs

Home

Introduction

For Merchants

For Resellers

Partner Ecosystem Management

Commerce Engine

Storefront Experience

APIs

API URL

Request Parameter

​API URL

​Request Parameter

API URL

Request Parameter