# Cool Service: sign in with Tokenbar

This service accepts a Tokenbar one-time token (OTK) as login. It checks the token with Tokenbar's public `POST https://prod.tokenbar.me/verify` and holds no Tokenbar credential.

1. Mint a one-time token at https://prod.tokenbar.me bound to this service (uses your Tokenbar JWT).

   ```sh
   curl -s -X POST "https://prod.tokenbar.me/tokens" -H "Authorization: Bearer $JWT" -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{"scopes": ["identity", "capabilities"], "audience": "cool-service.example.com"}'
   ```

2. Post its `otk` here within 5 minutes. The answer is 200 {session, address, account_type, capabilities}.

   ```sh
   curl -s -X POST "https://cool-service.tokenbar.io/login" -H 'Content-Type: application/json' -d '{"tokenbar_otk": "tbo_..."}'
   ```

3. Send the session as a Bearer token (or keep the cs_session cookie). It lasts 1 hour; on 401, log in again.

   ```sh
   curl -s "https://cool-service.tokenbar.io/me" -H "Authorization: Bearer <session>"
   ```

`POST /logout` ends the session. Errors are problem+json: 400 missing token, 401 invalid or expired token, 403 token without the identity scope, 429 too many attempts, 502 Tokenbar unreachable.