---
title: "Initiate a tokenized payment link session"
method: POST
path: "/tokenized-payment/v1/link-sessions/link"
tags: ["Account Linking"]
---

# Initiate a tokenized payment link session

`POST /tokenized-payment/v1/link-sessions/link`

Creates a PENDING link session and returns a `redirectUrl` and `appToken`. The merchant opens `redirectUrl` in an in-app browser and passes `appToken` as `X-ShopBack-App-Token`.

## Request body

- InitiateLinkSessionRequest
  - `callbackUrl` string, required — Merchant callback URL; must be on the per-channel allowlist.
  - `state` string, required — Merchant-supplied CSRF nonce; stored verbatim and echoed back unchanged in the callback redirect.
  - `merchantUserId` string, required — Merchant's opaque user ID. Used to verify that tokenized payments can only be made to the same customer who initiated the link session.
  - `userHint` UserHintDto, required
    - `phone` string — Pre-redacted phone number as registered with the merchant (e.g. "+6591xxxx67"). Displayed as-is on the consent page. The merchant is responsible for redacting before sending.
    - `email` string — Pre-redacted email address as registered with the merchant (e.g. "r***@example.com"). Displayed as-is on the consent page. The merchant is responsible for redacting before sending.

## Response `200`

Link session created; merchant should redirect user to `redirectUrl`.

- InitiateLinkSessionResponse
  - `linkToken` string, required — Opaque UUID identifying the linking session. Not embedded in `redirectUrl`.
  - `redirectUrl` string, required — Base ShopBack URL. Does NOT include any token; the merchant appends token(s) themselves before opening the in-app browser. Valid until `expiresAt`.
  - `expiresAt` string, required — Session TTL from creation. After this, the session is EXPIRED.
  - `appToken` string, required — HS256-signed JWT binding this response to the link session. The payload contains { linkToken } and expires at the same time as the session. Pass this as the X-ShopBack-App-Token header when opening the in-app browser.

## Other responses

- `400` — Invalid request body, malformed `callbackUrl`, `callbackUrl` not on the channel allowlist, or `userHint` missing or contains no sub-fields.
- `401` — Missing or invalid merchant JWT.

---

[API](https://skmtc.net/shopback/apis/online-payments-api.md) · [All operations](https://skmtc.net/shopback/apis/online-payments-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/shopback/online-payments-api/revisions/160fc287769e/schema)