Payer routes

Exchange a client secret

POST/v1/payer/deposit-requests/{id}/session

Exchanges a merchant_session client secret for a payer session. Single use.

Unauthenticated

Request

Shell
curl -fsS -X POST "$API/v1/payer/deposit-requests/dr_0198f80c-…/session" \
  -H "Content-Type: application/json" \
  -d '{ "client_secret": "cs_…" }'

Response

200 OK
{
  "payer_session": "…",
  "expires_at": "2026-09-07T12:00:00Z",
  "requirements": { "email": "not_required", "wallet": "pending", "merchant_session": "approved", "complete": true }
}

The exchange is the verification: mints a 24-hour session satisfying the policy, records an approved merchant_session attempt, and sets verification_completed_at while the request is live. Unknown, malformed, expired, and foreign secrets receive one answer. Response is Cache-Control: no-store.

Path parameters

iddr_ idrequired

Body

client_secretstringrequired

Response

{ payer_session, expires_at, requirements }.

Status codes

  • 409client_secret_used Already exchanged.
  • 401client_secret_invalid
  • 410deposit_request_not_payable Closed without verification.