Authenticate
Exchanges a JWT your server signs for a customer session, which opens the embedded dispute experience. Call it from your backend, never from the customer's browser. There is no request body: the signed JWT travels in the Authorization header as a bearer token, and its claims identify the customer. By default the response carries a single-use code your frontend redeems for the session; organizations configured for direct tokens receive sessionToken and refreshToken instead.
Responses
- application/json
- application/json
Request Example for get/v1/authenticate
curl /v1/authenticate \
--header 'Authorization: YOUR_SECRET_TOKEN'
{
"code": "string",
"expiresAt": "string",
"refreshExpiresAt": "string",
"refreshToken": "string",
"sessionToken": "string"
}