Exchange Google Token

Trades the one-time token from a Google sign in (sent back to the site's `/auth/callback?ott=…` page) for an access token and a refresh token. A first-time Google visitor is registered as a CRM contact.

POST/v1/auth/google/exchange

Authentication

Public key?key=pk_…

Public key in the `key` query parameter. No OAuth, no secret.

Edge cache: no-store

Query Parameters

keystring

required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

ottstring

required

The one-time token from the `ott` query parameter of the callback page.

analyticsobject

optional

Optional `{ visitorId, sessionId }` (two UUIDs) to attribute a new sign up in analytics.

Responses

200Success

application/json

typestring

modestring

accessTokenstring

refreshTokenstring

expiresInnumber

Errors

401`Missing token`, or `Invalid or expired token`: the token is unknown, already used, older than its lifetime, or was issued for another site.

403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Notes

Sent by the Panda widgets; you rarely call it by hand.
`mode` is `signup` when the visitor was just registered (source `google-signup`) and `login` for an existing account.
Tokens: `accessToken` lasts 1 hour (`expiresIn` is in seconds). `refreshToken` lasts 60 days and renews every time you refresh. Send the access token as `Authorization: Bearer`, never as a cookie.

Request

curl --request POST \
  --url "https://api.pandaidx.com/v1/auth/google/exchange?key={{public_key}}" \
  --header "Content-Type: application/json" \
  --data '{"ott":"example-one-time-token"}'

Response200 OK

{
  "type": "success",
  "mode": "login",
  "accessToken": "v1.example-access-token",
  "refreshToken": "example-refresh-token",
  "expiresIn": 3600
}