---
title: Issue or refresh an anonymous consumer token
slug: api-documentation/issue-or-refresh-an-anonymous-consumer-token
docTags: 
createdAt: 2026-08-27T16:53:30.249Z
---

{
  "id": "GxSz1i-Y7Xs7oPFYVjwmG",
  "type": "api-oas-v2",
  "data": {
    "method": "POST",
    "url": "https://api.upstartcommerce.com/api/v1/auth/guest",
    "servers": [
      {
        "url": "https://api.upstartcommerce.com/api/v1/auth/guest",
        "description": "Production"
      }
    ],
    "name": "Issue or refresh an anonymous consumer token",
    "description": "<p>Issues a short-lived JWT access token for anonymous browsing without credentials.</p>\n<p>The endpoint serves both new and returning guests through a single call:</p>\n<ul>\n<li><strong>No cookie</strong> (new visitor): creates a new guest session, returns access token,\nsets <code>guest_session</code> HttpOnly cookie.</li>\n<li><strong>Valid cookie</strong> (returning visitor): rotates the cookie atomically, returns a\nnew access token with the same stable session identity.</li>\n<li><strong>Unknown/expired cookie</strong> (reuse conflict or expiry): silently creates a new\nsession (logs a warning server-side), returns access token, sets new cookie.</li>\n</ul>\n<p><strong>Access token</strong> — short-lived JWT (1 hour), hold in JS memory, send on every API call.</p>\n<p><strong>Guest session cookie</strong> — long-lived opaque UUID (30 days by default), stored as\n<code>HttpOnly; Secure; SameSite=Strict</code>, invisible to JavaScript.</p>\n<p><strong>JWT claims</strong>: <code>sub = \"guest:&#x3C;stableSessionId>\"</code>, <code>type = \"consumer\"</code>, <code>roles = []</code>,\n<code>tenant</code> from the <code>x-upstart-tenant</code> header. The <code>stableSessionId</code> never changes for the\nlifetime of the guest session and can be used as a consistent identity key by downstream\nservices (e.g. cart-svc).</p>\n<p><strong>Rate limiting</strong>: requests are rate-limited by client IP (<code>guest:&#x3C;ip></code>).</p>",
    "contentType": "application/json",
    "request": {
      "pathParameters": [],
      "headerParameters": [
        {
          "name": "accept",
          "type": "string",
          "kind": "optional",
          "description": "Generated from available response content types",
          "enum": [
            "application/json"
          ],
          "default": "application/json"
        },
        {
          "kind": "optional",
          "name": "x-upstart-tenant",
          "type": "string",
          "example": "tenant-123",
          "description": "<p>Tenant identifier for multi-tenant authentication.</p>\n<p>Required when user is authorized for multiple tenants.\nOptional when user has exactly one authorized tenant (auto-selected).</p>"
        },
        {
          "kind": "optional",
          "name": "Cookie",
          "type": "string",
          "example": "guest_session=3fa85f64-5717-4562-b3fc-2c963f66afa6",
          "description": "<p>Optional <code>guest_session</code> cookie from a previous call</p>"
        }
      ],
      "queryParameters": [],
      "bodyDataParameters": [],
      "formDataParameters": [],
      "oAuthParameters": [],
      "cookieParameters": []
    },
    "responses": [
      {
        "statusCode": "200",
        "description": "<p>Guest access token issued. The <code>guest_session</code> cookie in the response replaces\nany previously presented cookie — always store the latest value.</p>",
        "jsonExample": "",
        "isExpanded": true,
        "headers": [
          {
            "kind": "optional",
            "name": "Set-Cookie",
            "type": "string",
            "example": "guest_session=7fd113e1-1d30-48d2-88e0-50ef573ecef0; Max-Age=2592000; Secure; HTTPOnly; SameSite=Strict",
            "description": "<p>Rotated guest session cookie. Always <code>HttpOnly; Secure; SameSite=Strict</code>.</p>"
          }
        ],
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "example": "{\"accessToken\":\"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\"expiresIn\":3600,\"tokenType\":\"Bearer\"}",
            "description": "<p>Response from <code>POST /api/v1/auth/guest</code>. The access token is returned in the body\n(store in JS memory, send on every API call). The opaque session token is set as an\n<code>HttpOnly</code> cookie by the server and is never exposed in the response body.</p>",
            "customType": "GuestTokenResponse",
            "schema": [
              {
                "name": "accessToken",
                "kind": "required",
                "type": "string",
                "description": "<p>JWT access token for anonymous API calls.</p>\n<p>Include in requests as: <code>Authorization: Bearer &#x3C;accessToken></code></p>\n<p><strong>Claims</strong>:</p>\n<ul>\n<li><code>sub</code>: <code>guest:&#x3C;stableSessionId></code> — stable across session rotations</li>\n<li><code>type</code>: <code>consumer</code></li>\n<li><code>roles</code>: <code>[\"customer.anonymous\"]</code> by default (configurable via <code>guest-session.guestRoles</code>)</li>\n<li><code>tenant</code>: active tenant ID</li>\n<li><code>iat</code> / <code>exp</code> / <code>iss</code>: standard JWT fields</li>\n</ul>",
                "example": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
              },
              {
                "name": "expiresIn",
                "kind": "required",
                "type": "integer<int64>",
                "description": "Seconds until the access token expires",
                "example": 3600,
                "format": "int64"
              },
              {
                "name": "tokenType",
                "kind": "required",
                "type": "string",
                "description": "<p>Token type (always \"Bearer\")</p>",
                "example": "Bearer"
              }
            ],
            "modelRef": "#/components/schemas/GuestTokenResponse",
            "isExpanded": true
          }
        ]
      },
      {
        "statusCode": "400",
        "description": "<p>Missing required <code>x-upstart-tenant</code> header</p>",
        "jsonExample": "",
        "isExpanded": true,
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "example": "{\"error\":\"tenant_required\",\"message\":\"x-upstart-tenant header is required\",\"code\":\"BAD_REQUEST\"}",
            "description": "Standard error response format",
            "customType": "ErrorResponse",
            "schema": [
              {
                "name": "error",
                "kind": "required",
                "type": "string",
                "description": "<p>Error type identifier:</p>\n<ul>\n<li><code>invalid_request</code>: Malformed request or missing required fields</li>\n<li><code>unauthorized</code>: Invalid credentials or token</li>\n<li><code>account_not_verified</code>: Account exists but email/phone not verified</li>\n<li><code>session_expired</code>: Maximum session lifetime exceeded, full re-login required</li>\n<li><code>unauthorized_tenant</code>: User not authorized for requested tenant</li>\n<li><code>tenant_required</code>: Multi-tenant user must specify tenant</li>\n<li><code>unauthorized_site</code>: User not authorized for requested site</li>\n<li><code>site_required</code>: Site context required for this operation</li>\n<li><code>no_authorized_sites</code>: User has no authorized sites</li>\n<li><code>forbidden</code>: Access denied (e.g., no authorized tenants)</li>\n<li><code>rate_limited</code>: Too many requests, try again later</li>\n<li><code>account_locked</code>: Account temporarily locked due to failed attempts</li>\n<li><code>internal_error</code>: Server-side error</li>\n</ul>",
                "example": "unauthorized"
              },
              {
                "name": "message",
                "kind": "required",
                "type": "string",
                "description": "<p>Human-readable error description</p>",
                "example": "Invalid username or password"
              },
              {
                "name": "code",
                "kind": "required",
                "type": "string<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>",
                "description": "HTTP status code name",
                "example": "UNAUTHORIZED",
                "enum": [
                  "BAD_REQUEST",
                  "UNAUTHORIZED",
                  "UNAUTHORIZED_TENANT",
                  "TENANT_REQUIRED",
                  "FORBIDDEN",
                  "RATE_LIMITED",
                  "ACCOUNT_LOCKED",
                  "INTERNAL_SERVER_ERROR"
                ]
              }
            ],
            "modelRef": "#/components/schemas/ErrorResponse",
            "isExpanded": true
          }
        ]
      },
      {
        "statusCode": "429",
        "description": "Rate limit exceeded",
        "jsonExample": "",
        "isExpanded": true,
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "example": "{\"error\":\"rate_limited\",\"message\":\"Too many guest token requests. Retry in 900s.\",\"code\":\"RATE_LIMITED\"}",
            "description": "Standard error response format",
            "customType": "ErrorResponse",
            "schema": [
              {
                "name": "error",
                "kind": "required",
                "type": "string",
                "description": "<p>Error type identifier:</p>\n<ul>\n<li><code>invalid_request</code>: Malformed request or missing required fields</li>\n<li><code>unauthorized</code>: Invalid credentials or token</li>\n<li><code>account_not_verified</code>: Account exists but email/phone not verified</li>\n<li><code>session_expired</code>: Maximum session lifetime exceeded, full re-login required</li>\n<li><code>unauthorized_tenant</code>: User not authorized for requested tenant</li>\n<li><code>tenant_required</code>: Multi-tenant user must specify tenant</li>\n<li><code>unauthorized_site</code>: User not authorized for requested site</li>\n<li><code>site_required</code>: Site context required for this operation</li>\n<li><code>no_authorized_sites</code>: User has no authorized sites</li>\n<li><code>forbidden</code>: Access denied (e.g., no authorized tenants)</li>\n<li><code>rate_limited</code>: Too many requests, try again later</li>\n<li><code>account_locked</code>: Account temporarily locked due to failed attempts</li>\n<li><code>internal_error</code>: Server-side error</li>\n</ul>",
                "example": "unauthorized"
              },
              {
                "name": "message",
                "kind": "required",
                "type": "string",
                "description": "<p>Human-readable error description</p>",
                "example": "Invalid username or password"
              },
              {
                "name": "code",
                "kind": "required",
                "type": "string<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>",
                "description": "HTTP status code name",
                "example": "UNAUTHORIZED",
                "enum": [
                  "BAD_REQUEST",
                  "UNAUTHORIZED",
                  "UNAUTHORIZED_TENANT",
                  "TENANT_REQUIRED",
                  "FORBIDDEN",
                  "RATE_LIMITED",
                  "ACCOUNT_LOCKED",
                  "INTERNAL_SERVER_ERROR"
                ]
              }
            ],
            "modelRef": "#/components/schemas/ErrorResponse",
            "isExpanded": true
          }
        ]
      },
      {
        "statusCode": "500",
        "description": "Internal server error",
        "jsonExample": "",
        "isExpanded": true,
        "subExamples": [
          {
            "label": "GENERATED",
            "code": "// Internal server error\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
          },
          {
            "label": "tokenGenerationFailed",
            "code": "// Token generation failed\n{\n  \"error\": \"internal_error\",\n  \"message\": \"Token generation failed\",\n  \"code\": \"INTERNAL_SERVER_ERROR\"\n}"
          },
          {
            "label": "serviceError",
            "code": "// Upstream service error\n{\n  \"error\": \"internal_error\",\n  \"message\": \"Failed to communicate with authentication backend\",\n  \"code\": \"INTERNAL_SERVER_ERROR\"\n}"
          }
        ],
        "schema": [
          {
            "kind": "optional",
            "type": "object",
            "description": "Standard error response format",
            "customType": "ErrorResponse",
            "schema": [
              {
                "name": "error",
                "kind": "required",
                "type": "string",
                "description": "<p>Error type identifier:</p>\n<ul>\n<li><code>invalid_request</code>: Malformed request or missing required fields</li>\n<li><code>unauthorized</code>: Invalid credentials or token</li>\n<li><code>account_not_verified</code>: Account exists but email/phone not verified</li>\n<li><code>session_expired</code>: Maximum session lifetime exceeded, full re-login required</li>\n<li><code>unauthorized_tenant</code>: User not authorized for requested tenant</li>\n<li><code>tenant_required</code>: Multi-tenant user must specify tenant</li>\n<li><code>unauthorized_site</code>: User not authorized for requested site</li>\n<li><code>site_required</code>: Site context required for this operation</li>\n<li><code>no_authorized_sites</code>: User has no authorized sites</li>\n<li><code>forbidden</code>: Access denied (e.g., no authorized tenants)</li>\n<li><code>rate_limited</code>: Too many requests, try again later</li>\n<li><code>account_locked</code>: Account temporarily locked due to failed attempts</li>\n<li><code>internal_error</code>: Server-side error</li>\n</ul>",
                "example": "unauthorized"
              },
              {
                "name": "message",
                "kind": "required",
                "type": "string",
                "description": "<p>Human-readable error description</p>",
                "example": "Invalid username or password"
              },
              {
                "name": "code",
                "kind": "required",
                "type": "string<BAD_REQUEST | UNAUTHORIZED | UNAUTHORIZED_TENANT | TENANT_REQUIRED | FORBIDDEN | RATE_LIMITED | ACCOUNT_LOCKED | INTERNAL_SERVER_ERROR>",
                "description": "HTTP status code name",
                "example": "UNAUTHORIZED",
                "enum": [
                  "BAD_REQUEST",
                  "UNAUTHORIZED",
                  "UNAUTHORIZED_TENANT",
                  "TENANT_REQUIRED",
                  "FORBIDDEN",
                  "RATE_LIMITED",
                  "ACCOUNT_LOCKED",
                  "INTERNAL_SERVER_ERROR"
                ]
              }
            ],
            "modelRef": "#/components/schemas/ErrorResponse",
            "isExpanded": true
          }
        ]
      }
    ],
    "hasXCodeSamples": false,
    "examples": {
      "languages": [
        {
          "id": "HY0Nxfav8jOF638xxtAte",
          "language": "curl",
          "label": "cURL",
          "code": "curl --request POST \\\n     --url https://api.upstartcommerce.com/api/v1/auth/guest \\\n     --header 'accept: application/json'"
        },
        {
          "id": "oaUPfC0bY_XD-28ic8we5",
          "language": "javascript",
          "label": "javascript",
          "code": "var myHeaders = new Headers();\nmyHeaders.append(\"accept\", \"application/json\");\nmyHeaders.append(\"content-type\", \"application/json\");\n\nvar requestOptions = {\n   method: 'POST',\n   headers: myHeaders,\n   redirect: 'follow'\n};\n\nfetch(\"https://api.upstartcommerce.com/api/v1/auth/guest\", requestOptions)\n   .then(response => response.text())\n   .then(result => console.log(result))\n   .catch(error => console.log('error', error));"
        },
        {
          "id": "ANyGMjA2HRLO4TlAp0N5z",
          "language": "ruby",
          "label": "Ruby",
          "code": "require \"uri\"\nrequire \"json\"\nrequire \"net/http\"\n\nurl = URI(\"https://api.upstartcommerce.com/api/v1/auth/guest\")\n\nhttps = Net::HTTP.new(url.host, url.port)\nhttps.use_ssl = true\n\nrequest = Net::HTTP::Post.new(url)\nrequest[\"accept\"] = \"application/json\"\nrequest[\"content-type\"] = \"application/json\"\n\nresponse = https.request(request)\nputs response.read_body\n"
        },
        {
          "id": "87wF98YoG7t9tLqEGMTcQ",
          "language": "python",
          "label": "Python",
          "code": "import requests\nimport json\n\nurl = \"https://api.upstartcommerce.com/api/v1/auth/guest\"\n\npayload = {}\nheaders = {\n   'accept': 'application/json',\n   'content-type': 'application/json'\n}\n\nresponse = requests.request(\"POST\", url, headers=headers, data=payload)\n\nprint(response.text)\n"
        }
      ],
      "selectedLanguageId": "HY0Nxfav8jOF638xxtAte"
    },
    "results": {
      "languages": [
        {
          "id": "Ih9YBDkdT2JVdvFyEtNw_",
          "language": "200",
          "code": "// Guest access token issued. The guest_session cookie in the response replaces\nany previously presented cookie — always store the latest value.\n{\n  \"accessToken\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...\",\n  \"expiresIn\": 3600,\n  \"tokenType\": \"Bearer\"\n}"
        },
        {
          "id": "1_AJDO4FopIOxktlE2p8G",
          "language": "400",
          "code": "// Missing required x-upstart-tenant header\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
        },
        {
          "id": "eEqyG-l9PDILZOI3RbcKp",
          "language": "429",
          "code": "// Rate limit exceeded\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
        },
        {
          "id": "1Do9qR-mudvDCnXYMAewP",
          "language": "500",
          "code": "// Internal server error\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}",
          "subExamples": [
            {
              "label": "GENERATED",
              "code": "// Internal server error\n{\n  \"error\": \"unauthorized\",\n  \"message\": \"Invalid username or password\",\n  \"code\": \"UNAUTHORIZED\"\n}"
            },
            {
              "label": "tokenGenerationFailed",
              "code": "// Token generation failed\n{\n  \"error\": \"internal_error\",\n  \"message\": \"Token generation failed\",\n  \"code\": \"INTERNAL_SERVER_ERROR\"\n}"
            },
            {
              "label": "serviceError",
              "code": "// Upstream service error\n{\n  \"error\": \"internal_error\",\n  \"message\": \"Failed to communicate with authentication backend\",\n  \"code\": \"INTERNAL_SERVER_ERROR\"\n}"
            }
          ]
        }
      ],
      "selectedLanguageId": "Ih9YBDkdT2JVdvFyEtNw_"
    }
  },
  "children": [
    {
      "text": ""
    }
  ]
}