Create One-Time Token

Creates a short-lived one-time token that hands the signed-in visitor over to the Panda dashboard without a second login.

POST/v1/auth/ott

Authentication

Public key + visitor?key=pk_… · Authorization: Bearer

Public key in the `key` query parameter, plus the signed-in visitor's access token as `Authorization: Bearer`.

Edge cache: no-store

keystring

required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

200Success

application/json

typestring

ottstring

401`Sign in required`: missing, expired or wrong-site access token.

403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Sent by the Panda widgets; you rarely call it by hand.
The token is valid for 60 seconds and is redeemed by the dashboard at `/auth/ott?t=<ott>`.

Request

curl --request POST \
  --url "https://api.pandaidx.com/v1/auth/ott?key={{public_key}}" \
  --header "Authorization: Bearer {{visitor_token}}"

Response200 OK

{
  "type": "success",
  "ott": "9f2c4b7a1d3e5f60a8b9c0d1e2f30415"
}