API DocsAPI Docs / Gyms / Subscriptions / Issue Checkin Token

POST /api/v1/gyms/{gym-id}/checkin-token

Rotates the gym's QR check-in code and returns the new plaintext token. The gym displays this token (typically as a QR code on a kiosk screen); athletes scan it and redeem it against their own subscription via QR check-in / QR check-out.

Security parameters

• TTL: each token expires 2 minutes after issuance.
• Rotation: every call issues a fresh token. Previously issued tokens stay valid until their own expiry, so a code already on screen does not die mid-scan; expired rows are pruned on each call.
• Storage: only a SHA-256 hash of the token is stored. The plaintext in the response is shown once.
• Throttle: 30 requests/minute — sized for a kiosk polling for the next code.
• Redemption idempotence: one displayed code may be redeemed by many athletes, but a subscription with an open check-in cannot check in again (400).

Permissions

URL Parameters

Request Body Parameters

None.

Response

201 Created

Example

{
  "data": {
    "token": "kW3n8b2XqL0pT7vYcRfZ9aH1mJ4sD6eGuI5oPxQw",
    "expires_at": "2026-09-02 10:32:00"
  }
}

Error Responses