curl --request POST \
--url https://api.skortorent.com/api/v1/tenants/onboarding-token \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"tenant_email": "jsmith@example.com",
"application_id": "<string>",
"property_id": "<string>"
}
'import requests
url = "https://api.skortorent.com/api/v1/tenants/onboarding-token"
payload = {
"tenant_email": "jsmith@example.com",
"application_id": "<string>",
"property_id": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
tenant_email: 'jsmith@example.com',
application_id: '<string>',
property_id: '<string>'
})
};
fetch('https://api.skortorent.com/api/v1/tenants/onboarding-token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.skortorent.com/api/v1/tenants/onboarding-token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'tenant_email' => 'jsmith@example.com',
'application_id' => '<string>',
'property_id' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.skortorent.com/api/v1/tenants/onboarding-token"
payload := strings.NewReader("{\n \"tenant_email\": \"jsmith@example.com\",\n \"application_id\": \"<string>\",\n \"property_id\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.skortorent.com/api/v1/tenants/onboarding-token")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"tenant_email\": \"jsmith@example.com\",\n \"application_id\": \"<string>\",\n \"property_id\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.skortorent.com/api/v1/tenants/onboarding-token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"tenant_email\": \"jsmith@example.com\",\n \"application_id\": \"<string>\",\n \"property_id\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"status": "success",
"message": "<string>",
"data": {
"token": "<string>",
"tenant_id": "<string>",
"is_profile_outdated": true,
"requires_login_with_skor": true
}
}{
"status": "error",
"message": "<string>"
}{
"status": "error",
"message": "<string>"
}{
"status": "error",
"message": "<string>"
}{
"status": "error",
"message": "<string>"
}{
"status": "error",
"message": "<string>"
}Generate Tenant Onboarding Token
Generates a short-lived tenant onboarding token used to start a browser
profile session with the JavaScript SDK for the application participant
identified by tenant_email. The email must belong to the application. If
no tenant account exists for that email, SKOR creates the minimal tenant
record required for onboarding and associates it with the API key.
The participant is linked to the tenant but remains pending while
onboarding is incomplete. Its consent_status changes to accepted
only after onboarding is completed in the iframe.
If an existing tenant account is not linked to the requesting API key,
the response contains a restricted verification token and
requires_login_with_skor: true. The SDK asks the tenant to log in with
SKOR and verify an OTP; this token is not a tenant login token. For an
incomplete profile, successful OTP verification links the key and displays
Profile linked with a Continue onboarding action if profile is pending. Clicking it redirects
the tenant to onboarding and resumes from the stored step using the
returned onboarding token.
Application consent remains pending until onboarding is completed.
Later requests for the same linked tenant and
key can receive the normal onboarding token directly.
A completed tenant also uses restricted verification while application
consent is pending or the profile is outdated. An outdated tenant sees
Profile linked after OTP and must explicitly choose Redo onboarding to
restart the normal iframe flow. OTP verification alone does not complete
or close that session. If application consent was already accepted and
the profile is current, the response contains token: null.
Call this from your server after creating the property and application. If
the response contains a token, hand it to the SDK’s
startProfileSession({ token }) in the browser. See the SDK guide
for the full flow.
curl --request POST \
--url https://api.skortorent.com/api/v1/tenants/onboarding-token \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"tenant_email": "jsmith@example.com",
"application_id": "<string>",
"property_id": "<string>"
}
'import requests
url = "https://api.skortorent.com/api/v1/tenants/onboarding-token"
payload = {
"tenant_email": "jsmith@example.com",
"application_id": "<string>",
"property_id": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
tenant_email: 'jsmith@example.com',
application_id: '<string>',
property_id: '<string>'
})
};
fetch('https://api.skortorent.com/api/v1/tenants/onboarding-token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.skortorent.com/api/v1/tenants/onboarding-token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'tenant_email' => 'jsmith@example.com',
'application_id' => '<string>',
'property_id' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.skortorent.com/api/v1/tenants/onboarding-token"
payload := strings.NewReader("{\n \"tenant_email\": \"jsmith@example.com\",\n \"application_id\": \"<string>\",\n \"property_id\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.skortorent.com/api/v1/tenants/onboarding-token")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"tenant_email\": \"jsmith@example.com\",\n \"application_id\": \"<string>\",\n \"property_id\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.skortorent.com/api/v1/tenants/onboarding-token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"tenant_email\": \"jsmith@example.com\",\n \"application_id\": \"<string>\",\n \"property_id\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"status": "success",
"message": "<string>",
"data": {
"token": "<string>",
"tenant_id": "<string>",
"is_profile_outdated": true,
"requires_login_with_skor": true
}
}{
"status": "error",
"message": "<string>"
}{
"status": "error",
"message": "<string>"
}{
"status": "error",
"message": "<string>"
}{
"status": "error",
"message": "<string>"
}{
"status": "error",
"message": "<string>"
}Authorizations
HTTP Bearer Authentication. Generate a shared token via
/authenticate/token, then pass it as Authorization: Bearer <token>.