getSecuredReferenceToken

Mints the reference token — a channel-scoped credential used as the bearer for GetReward.

Available

POST /api/getSecuredReferenceToken

Environment	URL
Production	https://rewardscenter.cheggout.com/api/getSecuredReferenceToken
UAT	https://rewardscenter-uat.cheggout.com/api/getSecuredReferenceToken

Authentication — Signed envelope

Call this from a scheduled job, not per request

The reference token identifies your channel, not a user, so one token serves all of your traffic. Refresh it hourly from a background job on your backend and cache the result. Minting one per user request adds latency for no benefit.

Request

Standard signed envelope:

Field	Type	Required	Description
CHANNELID	string	Yes	Your channel identifier, issued by Cheggout
SIGN	string	Yes	Base64 SHA256withRSA signature over the BDATA string
BDATA	string	Yes	Base64 of the payload below

BDATA payload

Field	Type	Required	Description
bName	string	Yes	Your channel name

The key is bName, matched case-sensitively

This endpoint reads bName. GetAuthToken reads channelName for the same concept. Sending the wrong key silently omits the value and produces a token that later fails.

Payload before encoding

{ "bName": "YOURCHANNEL" }

Example

curl -X POST https://rewardscenter-uat.cheggout.com/api/getSecuredReferenceToken \
  -H "Content-Type: application/json" \
  -d '{
        "CHANNELID": "YOURCHANNEL",
        "SIGN": "REPLACE_WITH_YOUR_BASE64_SIGNATURE",
        "BDATA": "eyAiYk5hbWUiOiAiWU9VUkNIQU5ORUwiIH0="
      }'

Response

Signed envelope from Cheggout:

Field	Type	Description
CHANNELID	string	Always "CHEGGOUT"
SIGN	string	Cheggout's signature — verify with their public key
BDATA	string	Base64 of the payload below

Decoded BDATA

Field	Type	Description
referenceKey	string	The reference token. Use as Authorization: Bearer <referenceKey> on GetReward.
expireDate	string	Expiry indication

Response envelope

{
  "CHANNELID": "CHEGGOUT",
  "SIGN": "REPLACE_WITH_CHEGGOUT_SIGNATURE",
  "BDATA": "REPLACE_WITH_BASE64_PAYLOAD"
}

Decoded BDATA

{
  "referenceKey": "REPLACE_WITH_TOKEN",
  "expireDate": "REPLACE_WITH_EXPIRY"
}

TBD expireDate has no documented format or time zone. Do not parse it as a contract. Refresh on a fixed hourly schedule and re-mint on an authentication failure. See Tokens.

Errors

Response	Meaning	What to do
{"STATUS":"FAILURE","ERRORSTRING":"Signature Mismatch!"}	Signature could not be verified	Check you signed the Base64 BDATA string, and that CHANNELID is correct
{"STATUS":"FAILURE","ERRORSTRING":"Internal Error!"}	Platform-side failure	Retry with backoff; escalate if persistent

Failure bodies are unsigned

These carry no SIGN. Check for the STATUS/ERRORSTRING shape before attempting signature verification, or your client will throw on a legitimate error response.

TBD No further error catalogue is published for this endpoint — no distinct codes for an unknown channel, an unwhitelisted IP or a malformed payload. Log any unrecognised body with the endpoint name and report it.

Usage pattern

Implementation notes:

• Refresh with a margin — every 50 minutes for an hourly token — so no user request waits on a mint.
• Single-flight the refresh so a burst doesn't trigger many concurrent mints.
• On a 401 from GetReward, force a refresh and retry the original call once.
• Never send this token to a client. It is channel-wide.

Next

• GetReward — use the token.
• GetAuthToken — the user-scoped equivalent.
• Tokens