Skip to content
Indiana
Dashboard
Docs
Browse docs / Create a guest customer

Create a guest customer

POST/api/v1/customers/guests

Generate a 256-bit guest proof on your trusted host. Retain it in an HttpOnly cookie and reuse it for creation retries. Only its hash is stored.

SDK 0.0.1Updated

Make the request

Generate a 256-bit guest proof on your trusted host. Retain it in an HttpOnly cookie and reuse it for creation retries. Only its hash is stored.

Credential
Server API key only. Call from your trusted backend.
Permission
sessions:create
Set the base URL and App ID from SDK setup. These examples use placeholders and do not execute requests. Never put a server key in browser code.
request.shShell
curl -X POST "$GROOVE_BASE_URL/api/v1/customers/guests" \  -H "Authorization: Bearer $GROOVE_SECRET_KEY" \  -H "X-Groove-Project: $GROOVE_PROJECT_ID" \  -H "X-Groove-Environment: sandbox" \  -H "Content-Type: application/json" \  -d '{  "guestToken": "gg_gc_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}'

The response is illustrative, not the result of a live request.

Request parameters

JSON body

guestTokenstringRequired

The guestToken value for this operation. Its accepted type and constraints are listed above and below.

pattern: ^gg_gc_[A-Za-z0-9_-]{43}$

fingerprintstringOptional

The fingerprint value for this operation. Its accepted type and constraints are listed above and below.

minLength: 1 · maxLength: 255

Response fields

Successful responses include requestId and scope. Use the actual business status or accepted field to determine the result. Optional fields are omitted when unavailable.

HTTP 200 · application/json

requestIduuidRequired

Server-generated HTTP request UUID. Include it when reporting a failed request.

scopeobjectRequired

The App and environment of this response. Headers only verify scope; they cannot switch key scope.

Show child fields
projectIdstringRequired

App ID bound to the credential.

minLength: 1

environmentenumRequired

Separate data scope: sandbox or live.

Show allowed values

"sandbox""live"

customerIduuidRequired

Indiana customer ID mapped from a verified identity on the server. Omit for customer-token calls, which use the token-bound customer.

guestTokenstringRequired

The guestToken value for this operation. Its accepted type and constraints are listed above and below.

pattern: ^gg_gc_[A-Za-z0-9_-]{43}$

guestExpiresAtdate-timeRequired

The guestExpiresAt value for this operation. Its accepted type and constraints are listed above and below.

Handle errors

Common failures
CodeRecovery
UNAUTHENTICATEDVerify the key or refresh the expired customer token once.
FORBIDDENCheck current key permissions and customer access.
INVALID_REQUESTCheck field types, UUIDs, decimal strings and mutually exclusive fields.
SCOPE_MISMATCHUse the App and environment bound to the credential.

Common failures

  • UNAUTHENTICATED

    Recovery
    Verify the key or refresh the expired customer token once.
  • FORBIDDEN

    Recovery
    Check current key permissions and customer access.
  • INVALID_REQUEST

    Recovery
    Check field types, UUIDs, decimal strings and mutually exclusive fields.
  • SCOPE_MISMATCH

    Recovery
    Use the App and environment bound to the credential.

Related:All request and error conventions·Back to endpoint index