Generates a temporary JWT access token used to initialize zerohash SDK modules on behalf of one of your end users. The platform authenticates to this endpoint with its own HMAC credentials; the returned JWT is then handed to the end-user client.

Identifying the end user:

• The Onboarding SDK accepts email to start a fresh onboarding, or participant_code to resume an existing user from where they dropped off. For a retry, send email and participant_code together — zerohash resolves the existing participant and the SDK comes up pre-filled (it is not participant_code alone).
• All other SDK experiences require participant_code (the user already exists).

Choosing a variant: the request body is an anyOf — pick the variant matching the SDK experience you are launching, set permissions accordingly, and include only that variant’s fields.

💡 Use the schema dropdown / per-variant examples on the request body below to load a ready-made payload for each experience.

Auto-revoke previous token (optional, off by default): when zerohash enables this setting for your platform, issuing a new client access token for a participant_code automatically revokes the token previously issued for that same participant. The previous token is rejected on its next request (403, JWT token is revoked) — immediately, with no grace period. Revocation is scoped to the {platform, participant} pair. /revoke_auth_token keeps working independently. Leave the setting off if your integration relies on multiple concurrent tokens per participant; contact your zerohash representative to enable it.