GetAuthToken

Mints a user token — scoped to one specific user — used by FetchRewardInfo and GetAllScratchCardsByUserId.

Available

POST /api/GetAuthToken

Environment	URL
Production	`https://rewardscenter.cheggout.com/api/GetAuthToken`
UAT	`https://rewardscenter-uat.cheggout.com/api/GetAuthToken`

Authentication — Signed envelope

Host discrepancy

The web widget documentation publishes GetAuthToken on a different host family. If you are integrating the JavaScript widget, confirm which host applies to your channel during onboarding. TBD — tracked in Open Items.

Request

Standard signed envelope — CHANNELID, SIGN, BDATA.

BDATA payload

Field	Type	Required	Description
`virtualId`	string	Yes	The user this token will represent
`channelName`	string	Yes	Your channel name

The key is channelName here

getSecuredReferenceToken reads bName for the same concept. These payloads are matched case-sensitively — using the wrong key silently omits the value.

Payload before encoding
{
  "virtualId": "pub_8f14e45fceea167a",
  "channelName": "YOURCHANNEL"
}

Example

curl -X POST https://rewardscenter-uat.cheggout.com/api/GetAuthToken \
  -H "Content-Type: application/json" \
  -d '{
        "CHANNELID": "YOURCHANNEL",
        "SIGN": "REPLACE_WITH_YOUR_BASE64_SIGNATURE",
        "BDATA": "REPLACE_WITH_BASE64_PAYLOAD"
      }'

Response

Signed envelope — CHANNELID: "CHEGGOUT", SIGN, BDATA.

Decoded BDATA

Field	Type	Description
`token`	string	The user token. Use as `Authorization: Bearer <token>`.
`expireDate`	string	Expiry indication

Decoded BDATA
{
  "token": "REPLACE_WITH_USER_TOKEN",
  "expireDate": "REPLACE_WITH_EXPIRY"
}

The token is passed as the bearer credential for reward reveal and other user-detail APIs.

Lifetime

Widget documentation states a one-hour validity, with re-minting done from your server.

TBD Exact lifetimes are configured per channel, and expireDate has no documented format or time zone. Do not parse it — refresh reactively on an authentication failure, or proactively when a user session starts. See Tokens.

Errors

Response	Meaning	What to do
`{"STATUS":"FAILURE","ERRORSTRING":"Signature Mismatch!"}`	Signature could not be verified	Check you signed the Base64 `BDATA` string and that `CHANNELID` is right
`{"STATUS":"FAILURE","ERRORSTRING":"Internal Error!"}`	Platform-side failure	Retry with backoff

Failure bodies carry no SIGN — check for this shape before verifying.

TBD No error catalogue distinguishes an unknown virtualId, a malformed payload or an unwhitelisted IP.

When to mint

Guidance:

Mint at session start, not at the moment of the tap, so the reveal is a single round trip.
Cache per user — one token serves all of that user's calls until it expires.
Single-flight the refresh so concurrent requests for the same user mint once.
Never mint from the client. Minting requires your private key.

Reference token vs user token

	Reference token	User token
Minted by	`getSecuredReferenceToken`	`GetAuthToken`
Scope	Your channel	One user
Payload key	`bName`	`channelName`
Refresh	Hourly, scheduled	Per user, on session start
Accepted by	`GetReward`	`FetchRewardInfo`, `GetAllScratchCardsByUserId`
Safe on a client	No	Only where the surface requires it

FetchRewardInfo — reveal a card.
GetAllScratchCardsByUserId — reward history.
Tokens

Request​

BDATA payload​

Example​

Response​

Decoded BDATA​

Lifetime​

Errors​

When to mint​

Reference token vs user token​

Next​