Exchange Login Ticket

POST

https://api.lootlocker.io/admin/v1/session/ticket

Exchanges a single-use login ticket (minted by POST /admin/v1/login/ticket) for a fresh admin API session. The response has the same shape as a successful login.

Tickets are consumed atomically, so a ticket can only ever be redeemed once; invalid, already-used or expired tickets return a deliberately vague 401.

Request

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200Success

application/json

A fresh session for the ticket's user.

Bodyapplication/json

🟠401Unauthorized

🟠400Bad Request

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.lootlocker.io/admin/v1/session/ticket' \
--header 'Content-type: application/json' \
--data '{
    "ticket": "login_2f8c1d..."
}'

Response Example

200 - Example 1

{
    "success": true,
    "auth_token": "string",
    "user": {
        "id": 0,
        "name": "string",
        "email": "string",
        "signed_up": 0,
        "is_verified": true,
        "organisations": [
            {
                "id": 0,
                "name": "string",
                "finalized_signup_at": "string",
                "subscribed": true,
                "games": [
                    {
                        "id": 0,
                        "name": "string"
                    }
                ]
            }
        ]
    }
}

Modified at 2026-09-23 13:50:13

Mint Login Ticket

Get API Keys