# Generate auth code

`GET https://api.nexus.gg/v1/manage/members/{playerId}/authCode`

Issues a short-lived code a creator can hand back to `nexusLink` (`POST /manage/members/link`) to attach their real Nexus account to a `playerId` you generated with `generateMember`.

It only works for members still in the publisher-managed state: a code `generateMember` created that nobody has linked a Nexus to yet. Linking a Nexus flips the node's type away from `PublisherManaged`, so once a `playerId` has been linked this lookup no longer matches it, and the call returns `400` with `code: ReferralNexusNotFound`. The same 400 covers a `playerId` that was never created with `generateMember`: the lookup requires an existing group-membership row for that `playerId`, and with none to join against the query returns nothing. Branch on `code`, not on `message`.

Calling this again for the same `playerId` overwrites the previous code (and its expiry) rather than issuing a second one, so only the most recently generated code is valid. The returned `authCode` expires 30 minutes after generation.

This method authenticates with a **secret** (`nexus_sk_...`) key.

## Authorizations

- `X-SHARED-SECRET` (string, header, required) - Send your **secret** API key (`nexus_sk_...`) in the `X-SHARED-SECRET` header. [Generate one](/authentication/api-keys/) in the Publisher Dashboard.

## Path parameters

- `playerId` (string, required) - PlayerId to generate an authentication code for. Must currently have an unclaimed, publisher-managed code from `generateMember`: a `playerId` that's already been linked (linking flips its node out of the publisher-managed state) or was never created returns `400` with `code: ReferralNexusNotFound`.

## Responses

### 200

Authentication code generated

#### Body (`application/json`)

- `authCode` (string) - Newly generated authentication code: a 6-digit numeric string formatted as two groups of three. Overwrites any earlier unclaimed code for this playerId, so only the most recently generated code is valid.
- `expiresAt` (string) - Timestamp after which this authCode is no longer valid: 30 minutes after it was generated.

### 400

Bad request

#### Body (`application/json`)

- `code` (string) - CodeNotInGroup: Creator group is private, and specified code is not linked to it<br /> InvalidGroup: No creator group was found with the specified groupId<br/> InvalidAuthCode: AuthCode provided is not valid or the nexus it represents is not a member of your program<br/> ExpiredAuthCode: AuchCode provided has expired<br/> NexusNotFound: No Nexus was found to match the provided code<br/> PlayerNotInGroup: No group member found for the given playerId<br/> PlayerAlreadyLinked: The playerId provided has already been linked with a group member<br/> MemberAlreadyLinked: The nexus represented by the auth code specified is already a member of your group and has been linked with a different playerId. Allowed values: InvalidGroup, CodeNotInGroup, InvalidAuthCode, ExpiredAuthCode, NexusNotFound, PlayerNotInGroup, UnknownError, PlayerAlreadyLinked, MemberAlreadyLinked.
- `message` (string) - A human-readable explanation. Log it; do not match on it, as the wording can change. Branch on `code` instead.