Reference / @open-music-sdk/user-token / userTokenIntake

Function: userTokenIntake()

function userTokenIntake(client, options): tUserTokenIntake;

Defined in: user-token/src/intake.ts:79

A handler for POST with a JSON body { "token": "..." }. Answers 204 once Apple has accepted the token and the store has it; otherwise { "error": ... } with 422 when the token is no good and 502 when Apple did not confirm it. Neither the token nor Apple's error text is ever echoed. Apple is asked through client, under its retry policy; bounding that wait is the caller's call.

What it is handed is checked and taken here, once: a mistake is a TypeError now and not on the first request, and nothing done to the options object afterwards changes where a token goes or whose it is.

userId is the authentication: it must return the signed-in user from your own session. Requiring application/json is the cross-site defence, since a form or a no-cors fetch on another site cannot send it; that holds only while your CORS policy does not let other origins send that header with credentials. Each token that reaches Apple costs a request against your developer token, and a 401 one more: rate-limit the route as you would a login.

Every answer is Cache-Control: no-store:

Status	Body	When
204	none	Apple accepted the token and the store has it
400	{ "error": "BadRequest" }	The body is not JSON, or has no string token
401	{ "error": "Unauthorized" }	userId(req) resolved to nothing
405	{ "error": "MethodNotAllowed" }	Not a POST; the answer carries Allow: POST
413	{ "error": "PayloadTooLarge" }	The body is over 8 KiB. It is counted as it arrives, and the rest is cancelled.
415	{ "error": "UnsupportedMediaType" }	The content type is not application/json
422	{ "error": "UserTokenInvalid" }	What was posted is no token, Apple answered 403, or Apple answered 401 for the listener; nothing is stored
502	{ "error": "<tag>" }	Apple did not confirm the token: DeveloperTokenInvalid, DeveloperTokenUnavailable, RateLimited, ApiError or NetworkError; nothing is stored

Parameters

client

tAppleMusicClient

The client to ask Apple with.

options

tIntakeOptions

Where an accepted token goes, and whose each request is.

Returns

tUserTokenIntake

The handler. It answers a status for everything about the request and for Apple's verdict, and rejects with what userId or the store rejects with, with a TypeError when userId resolves to something that is no string, with whatever a token provider, hook or rate limiter throws, as client.request passes it on, with whatever the runtime rejects with when the body cannot be read, and with the reason req.signal aborted with.

Throws

TypeError if client is not a client, options is not an object, store lacks get, set or delete, or userId is not a function; when the handler is created, not on a request.