BouncerBouncerDocs
Device

Create a device session link

Returns a short-lived link and its QR code for one of your devices (a kiosk, vending machine or point of sale). Scanning it starts a new session with the device's settings. Send Accept: application/json, and Content-Type: application/json when you send a body.

POST
/device/{deviceCode}/session-url

Authorization

bearerAuth

AuthorizationBearer <token>

Your organization's API token, sent as Authorization: Bearer YOUR_API_TOKEN. It looks like 1|abc123...: send all of it, including the part before the |.

An Owner or Admin creates tokens in the dashboard: open the user menu, choose Organization and go to the API Tokens section. The token is shown only once. Tokens do not expire; a revoked token stops working on the next request.

Keep tokens on your server. Never put them in browser or mobile app code.

The API Secret shown in the same section is not an API token: it verifies webhook signatures and the jwt added to your redirect.

In: header

Path Parameters

deviceCode*string

The device's Device Code, shown in the dashboard: 8 characters, uppercase letters and digits.

Match^[A-Z0-9]{8}$
Length8 <= length <= 8

Header Parameters

Accept*string

Must be application/json. Without it, errors come back as a redirect or an HTML page instead of JSON.

Default"application/json"
Value in"application/json"

Request Body

application/json

Optional. Send no body, or {}, to use the defaults.

qr_size?integer

Accepted for compatibility. It does not change the returned image, which is an SVG that scales to any size: set the size when you display it.

Default300
Range100 <= value <= 1000
ttl?integer

How long the link works, in seconds. It does not set the session's lifetime, which comes from the device's Session Expiration setting.

Default300
Range60 <= value <= 3600

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://app.bouncer.digital/api/v2/device/K3M9X2QA/session-url" \  -H "Authorization: Bearer YOUR_API_TOKEN" \  -H "Accept: application/json" \  -H "Content-Type: application/json" \  -d '{"ttl": 120}'
{
  "data": {
    "url": "https://app.bouncer.digital/s/K7Q2ZP9M",
    "qr": "data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4...",
    "expires_at": 1793181720
  }
}
{
  "message": "Device is not configured. Please set a redirect URL or webhook URL."
}
{
  "message": "Unauthenticated."
}
{
  "message": "Device not found, inactive, or belongs to a different organization."
}
{
  "message": "Token TTL must be at least 60 seconds.",
  "errors": {
    "ttl": [
      "Token TTL must be at least 60 seconds."
    ]
  }
}

Get session status

Returns the current status and result of a session that belongs to your organization. Use it as the source of truth, also to confirm what a webhook told you. Send Accept: application/json; without it, errors come back as redirects or HTML instead of JSON.

Devices

Configure physical and virtual devices for verification