Rewards
PUBLIC (no API key): exchange a host-signed token for a 15-minute read-only session. Each token works once (jti); CORS limited to the key's allowedOrigins
POST
application/json- body
kid*stringtoken*stringHS256 JWT signed by your server: sub, prg, iat, exp (≤ 15 min after iat), jti.
OK
application/json- response
data*error*nullcurl -X POST "https://example.com/rewards/widget/session" \ -H "Content-Type: application/json" \ -d '{ "kid": "string", "token": "string" }'{ "data": { "sessionToken": "string", "expiresAt": "2019-08-24T14:15:22Z", "scope": "read" }, "error": null}