post
https://api.acc.funtrips.io/{stage}/session/carrefour/token
PUBLIC
Verifies a Carrefour-issued Gigya JWT and mints a Cognito session
for the user. Designed for the iframe handoff: the front-end
picks up the bearer via Gigya postMessage and posts it here
directly.
The Gigya bearer is signature-verified against the issuer's
public key (fetched + cached per apiKey + kid). Tokens
signed by issuers not on the allow-list are rejected before any
provider call.
The active campaign comes from the x-campaign-id header — the
Gigya bearer is identity proof, not campaign proof. The
accountuid + loyalty_card (BONUS) Gigya claims are projected
into the session JWT's integrator_params so downstream Maxxing
flows can skip re-decoding the bearer.
Recent Requests
Log in to see full request history
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Loading…