Verify OTP code and return session token with customer data. Creates customer if new. Session token valid for 30 minutes. Authentication via X-API-Key header (partner API key).
API key for partner access via APISIX key-auth plugin
Partner API key
Customer ID (KSUID or user PK)
True if customer was just created
Session token (30min TTL) for subsequent OTP-protected requests
Customer full name
Current points balance
Loyalty tier