> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fourdos.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Mint a signed ad identity for a signed-in fan

> Server to server only: authenticate with an organization API key, never from a browser. Name the fan by your own `member_external_id` or by the platform `user_id` (exactly one). The token is signed by the platform, bound to your organization and that member, and expires after one hour; hand it to your page, which passes it to `GET /v1/ads/serve`. A page cannot forge one or use another club's. Minting stores nothing.



## OpenAPI

````yaml https://api.develop.fourdos.dev/openapi/partner.json post /v1/ads/identity-tokens
openapi: 3.1.0
info:
  title: 4D OS Partner API
  version: 0.1.0
  description: >-
    REST API for 4D OS partners. Authenticate with your organization API key:
    `Authorization: Bearer <key>`.


    Requests and responses are JSON with `snake_case` field names. Errors share
    one envelope: `{ "error": { "code", "status", "message", "details"? } }`.


    Mutating endpoints that declare it accept an `Idempotency-Key` header so
    retries are safe.


    Bulk-migrating members? See the [Migrating to 4D
    guide](https://docs.fourdos.dev/walkthroughs/migrate-existing-members) for
    the canonical import schema, a worked example, and the `/v1/imports`
    sequence.
servers:
  - url: https://api.develop.fourdos.dev
security:
  - partnerApiKey: []
tags:
  - name: Users
    description: Create, read, and manage users and their org membership
  - name: Imports
    description: Bulk member import jobs (staging → validate → commit)
  - name: API keys
    description: Issue, list, and revoke server-side organization API keys
  - name: Modules
    description: >-
      Publish private modules, install visible modules, and manage their
      credentials
  - name: Ingest
    description: Receive signed native events from an installed module
  - name: Engagement
    description: Browser event tracking (publishable keys) and tracking-key management
  - name: Revenue
    description: Report sales and refunds for the club's revenue dashboards
  - name: Ad delivery
    description: Fill a club site's ad slots, for anonymous or signed-in fans
  - name: Ad entries
    description: Fans entering a sponsor's draw, reported by the club's backend
paths:
  /v1/ads/identity-tokens:
    post:
      tags:
        - Ad delivery
      summary: Mint a signed ad identity for a signed-in fan
      description: >-
        Server to server only: authenticate with an organization API key, never
        from a browser. Name the fan by your own `member_external_id` or by the
        platform `user_id` (exactly one). The token is signed by the platform,
        bound to your organization and that member, and expires after one hour;
        hand it to your page, which passes it to `GET /v1/ads/serve`. A page
        cannot forge one or use another club's. Minting stores nothing.
      operationId: createAdIdentityToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AdIdentityTokenBody'
      responses:
        '200':
          description: The token and its expiry
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AdIdentityTokenResponse'
        '401':
          description: Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: The credential is not an organization API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: No active member of the key's organization matches
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: The body names no member, or both kinds of id
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Ad identity token rate limit exceeded for this key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - partnerApiKey: []
components:
  schemas:
    AdIdentityTokenBody:
      type: object
      properties:
        member_external_id:
          type: string
          minLength: 1
          maxLength: 1024
        user_id:
          type: string
          format: uuid
          pattern: >-
            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
      additionalProperties: false
    AdIdentityTokenResponse:
      type: object
      properties:
        identity_token:
          type: string
          description: >-
            Opaque. Pass it unchanged as `identity_token` on `GET
            /v1/ads/serve`; it cannot be read or edited.
        expires_at:
          type: string
          format: date-time
          description: One hour after minting. Mint a new one before then.
      required:
        - identity_token
        - expires_at
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            status:
              type: integer
            message:
              type: string
            details:
              type: object
              additionalProperties: true
          required:
            - code
            - status
            - message
      required:
        - error
  securitySchemes:
    partnerApiKey:
      type: http
      scheme: bearer
      description: >-
        Organization API key (`org_...`) sent as `Authorization: Bearer <key>`.
        Keys are scoped to one organization; every request operates within that
        tenant.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.