Create a member token

POST/v1/member_tokens

Issues a token for one member. Call it from your server only, after you have checked that the guest is signed in to your app. Identify the member by unPLUG id or by your own external_id, whichever you store.

Permissions: Secret key with member_tokens:create.

Guide

Authentication

Request headers#

Idempotency-Keystring
Any string up to 255 characters; use a UUID v4. Kept 24 hours per key (or member) and endpoint. Same key and body replays the first response with Idempotent-Replayed: true.
Max Length 255

Request body#

member_idstring (uuid)
The member's unPLUG id. Send this or external_id, not both.
external_idstring
Your id for the guest, as set when you created the member.

Field	Description
`token`string	Opaque. Don't parse it or rely on its length.
`expires_at`string	15 minutes after issue.
`member_id`string (uuid)	The member the token acts for.

Keep the token in memory in the app. If you store it, use the platform's secure storage (Keychain on iOS, EncryptedSharedPreferences on Android). On the web, keep it out of localStorage.

Response fields#

Returns 201 with MemberToken

tokenstring
Opaque, starts with mt_.
expires_atstring (date-time)
member_idstring (uuid)

POST/v1/member_tokens

1
2
3
4curl -X POST $UNPLUG_API/member_tokens \
  -H "Authorization: Bearer $UNPLUG_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "external_id": "usr_10482" }'

1
2
3
4
5
6
7
8
9const response = await fetch(`${process.env.UNPLUG_API}/member_tokens`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.UNPLUG_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ external_id: "usr_10482" }),
});
const data = await response.json();

1
2
3
4
5
6
7
8
9
10
11import os
import requests

response = requests.post(
    f"{os.environ['UNPLUG_API']}/member_tokens",
    headers={
        "Authorization": f"Bearer {os.environ['UNPLUG_KEY']}",
    },
    json={"external_id": "usr_10482"},
)
data = response.json()

Response JSON201

1
2
3
4
5{
  "token": "mt_4kQ9xV2mR7tB8nW3pL6yZ1cH5fJ0dS",
  "expires_at": "2026-11-03T18:37:11Z",
  "member_id": "3f2b8c1e-6d0a-4e7b-9f3c-2a1d5e8b7c40"
}

Error descriptions#

400Bad request

invalid_request

Both or neither of member_id and external_id were sent.

404Not found

member_not_found

No member with that id or external_id. Create the member first with POST /v1/members.

410Gone

member_deleted

The member asked to delete their account. Sign the guest out.

Any endpoint can also return the common errors.

400 Bad request

1
2
3
4
5
6
7{
  "type": "https://docs.unplugdining.com/reference/errors#invalid_request",
  "title": "Bad request",
  "status": 400,
  "code": "invalid_request",
  "detail": "Both or neither of member_id and external_id were sent."
}