Verify a submitted PIN (single-shot)

Verifies the PIN the player entered against the minted one-time session. Single-shot and never retried: the backend consumes sessions on success and rate-limits failures.

The x-secure-session header carries the sessionToken from the mint response. When valid is true, the response payload is the full backend verify response; a non-valid response reports locked and the attempt counter.

POST /api/v1/security/pin-session/{id}/verify

Verify a submitted PIN (single-shot)

cURL

curl --request POST \
  --url https://api.musterbox.com/api/v1/security/pin-session/{id}/verify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "pin": "482915",
  "amount": "9.99",
  "destinationAddress": 9.78200031609046e+47,
  "idempotencyKey": "buy-arena-bundle-8f3b"
}
'

200

{
  "valid": true,
  "locked": true,
  "attempt": 123
}

Authorizations

bearerAuthsecureSession

Authorization · string · header · required

Player access token returned by login/refresh.

Path Parameters

id · string · required

The sessionId returned by mint.

Body

application/json

pin · string · required

The PIN the player entered.

Example:

"482915"

amount · string · required

The authorized amount as a decimal string.

Example:

"9.99"

destinationAddress · string · required

Wallet destination the player is authorizing.

Example:

9.78200031609046e+47

idempotencyKey · string · required

Client-generated key scoping one authorized withdrawal.

Example:

"buy-arena-bundle-8f3b"

Response

200

application/json

Verification outcome (valid true or false with lock/attempt details).

valid · boolean

Whether the PIN was accepted. When true the object also carries the full backend verify payload.

locked · boolean

Whether the session is now rate-limited after the failure.

attempt · integer

Failure attempt counter.