API DocsAPI Docs / POST /api/v1/gyms/{gym-id}/checkin-token

POST /api/v1/gyms/{gym-id}/checkin-token

Rotates the gym's QR check-in code and returns the new plaintext token. The gym displays this token (typically as a QR code on a kiosk screen); athletes scan it and redeem it against their own subscription via QR check-in / QR check-out.

Security parameters

• TTL: each token expires 2 minutes after issuance.
• Rotation: every call issues a fresh token. Previously issued tokens stay valid until their own expiry, so a code already on screen does not die mid-scan; expired rows are pruned on each call.
• Storage: only a SHA-256 hash of the token is stored. The plaintext in the response is shown once.
• Throttle: 30 requests/minute, sized for a kiosk polling for the next code.
• Redemption idempotence: one displayed code may be redeemed by many athletes, but a subscription with an open check-in cannot check in again (400).

Permissions