Create a customer-portal session

Mint a short-lived bearer token that authenticates a specific customer against /v2/customer-portal/*. Returns an opaque rkcps_... token that expires in 60 minutes by default. Call this server-side from the merchant's backend, then hand the token to the customer's browser or embedded client. Treat the token like a password — never log it and never expose it to untrusted code.

Related endpoints

• GET /customer-portal/customer — Retrieve the authenticated customer
• GET /customer-portal/subscriptions — List the authenticated customer's subscriptions
• GET /customer-portal/subscriptions/{id} — Retrieve a subscription
• POST /customer-portal/subscriptions/{id}/cancel — Cancel a subscription
• GET /customer-portal/invoices — List the authenticated customer's invoices
• GET /customer-portal/invoices/{id} — Retrieve an invoice
• GET /customer-portal/mandates — List the authenticated customer's Direct Debit mandates
• POST /customer-portal/mandates/{id}/re-authorize — Re-authorise a Direct Debit mandate with new bank details

Common errors

• 401 unauthenticated — missing, malformed, or revoked API key.
• 404 resource_missing — the referenced resource does not exist or is not visible to your key.

Idempotency

Pass an Idempotency-Key header (UUID v4 recommended) to make retries safe. Keys are valid for 24 hours; see the idempotency guide.

curl -X POST "https://api.revkeen.com/v2/customer-portal/sessions" \
  -H "x-api-key: $REVKEEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_id": "cus_a1b2c3d4e5f6",
    "ttl_minutes": 60
  }'

{
  "data": {
    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
    "customer_id": "160c0c4b-9966-4dc1-a916-8407eb10d74e",
    "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea",
    "url": "http://example.com",
    "expires_at": "2019-08-24T14:15:22Z",
    "created_at": "2019-08-24T14:15:22Z"
  }
}

{
  "error": {
    "type": "string",
    "code": "string",
    "message": "string"
  }
}

{
  "error": {
    "type": "string",
    "code": "string",
    "message": "string"
  }
}