Sign in

v46

latestOpenAPI 3.0.0raw.githubusercontent.com2026-08-011274550.0 KB
Auth

Verify Marketing Access Token

Verifies and consumes a single-use access token issued by the Meteor bluehive:login-links package. Used by the marketing site auth callback to resolve a user from an opaque token.

post/v1/auth/verify-token

Request body

tokenstring required

Plaintext single-use access token issued by the Meteor app (bluehive:login-links) for the marketing auth flow.

typestring

Expected token type (e.g. "marketing-auth"). Defaults to "marketing-auth".

Response

Default Response

validboolean required
reasonstring

Reason the token is invalid (only present when valid=false)

loginTokenstring

Plaintext Meteor resume login token freshly minted for the user. Only present when valid=true. Callers should store this securely (e.g. HttpOnly cookie) and present it via the x-login-token header (with x-user-id) on subsequent API requests. The hashed form is also persisted in services.resume.loginTokens on the user document so Meteor can validate it as a normal session.

hashedLoginTokenstring

SHA-256(base64) of loginToken. Convenience for callers that prefer the pre-hashed x-hashed-login-token header. Only present when valid=true.

expiresInnumber

Lifetime of the minted loginToken in seconds. Only present when valid=true.