Customer session tokens

import crypto from 'node:crypto'

function createSessionToken({
  keyId,
  secret,
  siteId,
  customerId,
  email,
  scopes,
  lifetimeSeconds,
}) {
  const issuedAt = Math.floor(Date.now() / 1000)

  const payload = {
    // format version, always 2
    v: 2,
    // your Key ID, e.g. '4821'
    key_id: keyId,
    // your LoyaltyLion site ID, e.g. 12345
    site_id: siteId,
    // their ID in your store (= merchant_id), always a string
    customer_id: String(customerId),
    // their email address
    email,
    // when the token was issued: a unix timestamp, in seconds
    iat: issuedAt,
    // when it expires: a unix timestamp, in seconds
    exp: issuedAt + lifetimeSeconds,
    // ['read'], ['write'] or both (write does not include read)
    scopes,
  }

  const encoded = Buffer.from(JSON.stringify(payload)).toString('base64url')

  // sign with your SDK token secret
  const signature = crypto
    .createHmac('sha256', secret)
    .update(encoded)
    .digest('hex')

  return `${encoded}.${signature}`
}

// e.g. a 15-minute read+write token:
const token = createSessionToken({
  keyId: process.env.LOYALTYLION_SDK_TOKEN_KEY_ID,
  secret: process.env.LOYALTYLION_SDK_TOKEN_SECRET,
  siteId: 12345,
  customerId: '6072819304',
  email: 'shopper@example.com',
  scopes: ['read', 'write'],
  lifetimeSeconds: 900,
})

require 'base64'
require 'json'
require 'openssl'

def create_session_token(key_id:, secret:, site_id:, customer_id:, email:, scopes:, lifetime_seconds:)
  issued_at = Time.now.to_i

  payload = JSON.generate({
    # format version, always 2
    v: 2,
    # your Key ID, e.g. '4821'
    key_id: key_id,
    # your LoyaltyLion site ID, e.g. 12345
    site_id: site_id,
    # their ID in your store (= merchant_id), always a string
    customer_id: customer_id.to_s,
    # their email address
    email: email,
    # when the token was issued: a unix timestamp, in seconds
    iat: issued_at,
    # when it expires: a unix timestamp, in seconds
    exp: issued_at + lifetime_seconds,
    # ['read'], ['write'] or both (write does not include read)
    scopes: scopes,
  })

  encoded = Base64.urlsafe_encode64(payload, padding: false)
  # sign with your SDK token secret
  signature = OpenSSL::HMAC.hexdigest('SHA256', secret, encoded)

  "#{encoded}.#{signature}"
end

# e.g. a 15-minute read+write token:
token = create_session_token(
  key_id: ENV['LOYALTYLION_SDK_TOKEN_KEY_ID'],
  secret: ENV['LOYALTYLION_SDK_TOKEN_SECRET'],
  site_id: 12345,
  customer_id: '6072819304',
  email: 'shopper@example.com',
  scopes: ['read', 'write'],
  lifetime_seconds: 900,
)

function create_session_token($key_id, $secret, $site_id, $customer_id, $email, $scopes, $lifetime_seconds) {
  $issued_at = time();

  $payload = json_encode([
    // format version, always 2
    'v' => 2,
    // your Key ID, e.g. '4821'
    'key_id' => $key_id,
    // your LoyaltyLion site ID, e.g. 12345
    'site_id' => $site_id,
    // their ID in your store (= merchant_id), always a string
    'customer_id' => (string) $customer_id,
    // their email address
    'email' => $email,
    // when the token was issued: a unix timestamp, in seconds
    'iat' => $issued_at,
    // when it expires: a unix timestamp, in seconds
    'exp' => $issued_at + $lifetime_seconds,
    // ['read'], ['write'] or both (write does not include read)
    'scopes' => $scopes,
  ]);

  $encoded = rtrim(strtr(base64_encode($payload), '+/', '-_'), '=');
  // sign with your SDK token secret
  $signature = hash_hmac('sha256', $encoded, $secret);

  return $encoded . '.' . $signature;
}

// e.g. a 15-minute read+write token:
$token = create_session_token(getenv('LOYALTYLION_SDK_TOKEN_KEY_ID'), getenv('LOYALTYLION_SDK_TOKEN_SECRET'), 12345, '6072819304', 'shopper@example.com', ['read', 'write'], 900);

{
  "error": {
    "code": "token_expired",
    "message": "Session token has expired. Fetch a fresh session token from your backend and retry the request"
  }
}

{
  "error": {
    "code": "insufficient_scope",
    "message": "Requires scope [write] but session token only has scopes [read]"
  }
}