Exchange a fan experience launch token

Exchanges the opaque experience token an app's fan-experience surface received in its iframe URL for the resolved experience, the fan's identity, and the fan's entitlement to the experience.

The token is bound to the app that owns the experience: a token minted for one app cannot be exchanged with another app's credentials (403).

Returns 400 if the token is invalid or expired, and 404 if the experience no longer exists.

{
  "token": "exp_2f1c…"
}