Sign In with Link Token - Plugixa Car Wash for WordPress

POST /plugixa-carwash/v1/public/account/sign-in

Exchange the token from a sign-in link (the pcw_login parameter) for a session. The link is used up.

Needs the Customer accounts app on. Open to anyone. Rate-limited per visitor address to 20 an hour (bucket carwash_account_sign_in).

Request

POST https://your-site.example/wp-json/plugixa-carwash/v1/public/account/sign-in

Request body

Content type: application/json

Field	Type	Required	Description
`token`	`string`	Yes	The 32-character token from the link.

{
  "token": "5e2d7c1a9b8f4e3d2c1b0a9f8e7d6c5b"
}

Responses

`200` OK. `data` is the session.

{
  "success": true,
  "data": {
    "session": "3b8f0c9d2e4a4f1b9c7d6e5f4a3b2c1d",
    "expires_at": "2026-12-12T09:30:00+00:00"
  }
}

Field	Type	Meaning
`data.session`	`string`	Send it as the `X-PCW-Session` header on every account route
`data.expires_at`	`string`	When it stops working, 30 days on, as an ISO 8601 UTC time

Only a hash of each token is stored. The session travels in a header, never a cookie, so another site cannot make the browser use it.

Errors

Status	Code	When
`401`	`plugixa_carwash_link_invalid`	The token is unknown, expired or already used: “That sign-in link has expired or was already used. Ask for a new one.”
`429`	`plugixa_carwash_rate_limited`	This address has used up its requests for the hour.

Plus the errors every endpoint can return.

Examples

curl -s -X POST "https://your-site.example/wp-json/plugixa-carwash/v1/public/account/sign-in" \
  -H "Content-Type: application/json" \
  -d '{"token":"5e2d7c1a9b8f4e3d2c1b0a9f8e7d6c5b"}'

<?php
$ch = curl_init('https://your-site.example/wp-json/plugixa-carwash/v1/public/account/sign-in');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        'token' => '5e2d7c1a9b8f4e3d2c1b0a9f8e7d6c5b',
    ]),
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

const response = await fetch('https://your-site.example/wp-json/plugixa-carwash/v1/public/account/sign-in', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ token: '5e2d7c1a9b8f4e3d2c1b0a9f8e7d6c5b' }),
});
const { data } = await response.json();