GET /session/token

The Session Token API redeems a Storefront Gateway action token, and calls/invokes the next Process as defined by the token’s context. The next Process may be:

a single API or step like the Activate User (and User Attribute) Process that verifies a user’s email or mobile.
a multi-step process such as the Accept or Decline Service Invitation Process that requires more information from the user. Upon acceptance of the invite, the user is directed through the required steps to complete their onboarding.

Token Issuance & Redemption

There are two methods on how action tokens are issued and redeemed:

A long-form, clickable verification link that includes a redirect URL and the actual token value (appended to the end of the URL string). Once the user clicks this link, the redirect URL should navigate back to the client application, and the application provides that token value in this API request URL.
A short-form, custom One-time Passcode (OTP) that represents the token value stored in Storefront Gateway. The user must manually supply the OTP to a Process through the application UI, and the UI must then supply both the OTP and its corresponding PKAT in this API request URL.

Note: The notification types that your end users receive are based on the notification settings and templates used in your flows. These settings are configured in the Storefront Gateway Admin console. See the Storefront Gateway Admin Guide About Notification Services and Notification Templates for more details.

API URLs

GET https://{your.tenant.url}/session/token?token={**token**}
GET https://{your/tenant.url}/session/token?customToken={**OTP**}&pkat={**PKAT**}

Request Parameters

`token`	Action token value that’s appended to the end of the redirect URL sent to the end user.Note: Redirect URLs are defined in the Storefront Gateway Admin console > Authentication > Tokens > Advanced token Settings page. An Admin user can set separate redirect URLs for each of the Processes. This configuration can used for end users that receive clickable links (versus OTPs) are redirected to the landing page you’ve defined. Alternatively, you can set a single landing page for all your Processes. This configuration requires that the landing page extracts the token value from the redirect URL to call or invoke the Session Token API.
`customToken`	Short-form One-time Passcode (OTP) that represents the actual action token issued and stored in Storefront Gateway. Used in cases where you want to send the user a short code, and prompt the user to enter the code into the client application UI.
`pkat`	Proof Key for Action Token is sent to the client application UI at the end of any Process that issues and sends an action token to a user’s specified contact channel. The PKAT is required for OTP verification and Token Resend PUT /session/token?pkat={pkat} functionality.
As a developer, determine the required notification settings based on what token types are sent to your end users. For example, if the system issues OTPs to end users, then your application requires a UI page that allows a user to provide the OTP to this API.

The following Processes are invoked using the Session Token API:

Parent topic:Process APIs

Home

Introduction

For Merchants

For Resellers

Partner Ecosystem Management

Commerce Engine

Storefront Experience

APIs

Token Issuance & Redemption

API URLs

Request Parameters

​Token Issuance & Redemption

​API URLs

​Request Parameters

​Related Processes

Token Issuance & Redemption

API URLs

Request Parameters

Related Processes