Generate auth code

Issues a short-lived code a creator can hand back to nexusLink (POST /manage/members/link) to attach their real Nexus account to a playerId you generated with generateMember.

It only works for members still in the publisher-managed state: a code generateMember created that nobody has linked a Nexus to yet. Linking a Nexus flips the node’s type away from PublisherManaged, so once a playerId has been linked this lookup no longer matches it, and the call returns 400 with code: ReferralNexusNotFound. The same 400 covers a playerId that was never created with generateMember: the lookup requires an existing group-membership row for that playerId, and with none to join against the query returns nothing. Branch on code, not on message.

Calling this again for the same playerId overwrites the previous code (and its expiry) rather than issuing a second one, so only the most recently generated code is valid. The returned authCode expires 30 minutes after generation.

This method authenticates with a secret (nexus_sk_...) key.

Authorizations

X-SHARED-SECRET

required

stringheader

Send your secret API key (nexus_sk_...) in the X-SHARED-SECRET header. Generate one in the Publisher Dashboard.

Parameters

Path Parameters

playerId

required

string

Example

player_8f2c41d0

PlayerId to generate an authentication code for. Must currently have an unclaimed, publisher-managed code from generateMember: a playerId that’s already been linked (linking flips its node out of the publisher-managed state) or was never created returns 400 with code: ReferralNexusNotFound.

Responses

200

Authentication code generated

application/json

object

authCode

Newly generated authentication code: a 6-digit numeric string formatted as two groups of three. Overwrites any earlier unclaimed code for this playerId, so only the most recently generated code is valid.

string

expiresAt

Timestamp after which this authCode is no longer valid: 30 minutes after it was generated.

string format: date-time

400

Bad request

application/json

object

code

CodeNotInGroup: Creator group is private, and specified code is not linked to it
InvalidGroup: No creator group was found with the specified groupId
InvalidAuthCode: AuthCode provided is not valid or the nexus it represents is not a member of your program
ExpiredAuthCode: AuchCode provided has expired
NexusNotFound: No Nexus was found to match the provided code
PlayerNotInGroup: No group member found for the given playerId
PlayerAlreadyLinked: The playerId provided has already been linked with a group member
MemberAlreadyLinked: The nexus represented by the auth code specified is already a member of your group and has been linked with a different playerId.

string

Allowed values: InvalidGroup CodeNotInGroup InvalidAuthCode ExpiredAuthCode NexusNotFound PlayerNotInGroup UnknownError PlayerAlreadyLinked MemberAlreadyLinked

message

A human-readable explanation. Log it; do not match on it, as the wording can change. Branch on code instead.

string

GET

/manage/members/{playerId}/authCode

const url = 'https://api.nexus.gg/v1/manage/members/player_8f2c41d0/authCode';
const options = {method: 'GET', headers: {'X-SHARED-SECRET': 'nexus_sk_your_key_here'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.nexus.gg/v1/manage/members/player_8f2c41d0/authCode \
  --header 'X-SHARED-SECRET: nexus_sk_your_key_here'

Example

{
  "authCode": "028-311",
  "expiresAt": "2026-03-13T18:02:28Z"
}

Example

{
  "code": "InvalidGroup",
  "message": "Invalid Group ID: V1StGXR8_Z5jdHi6B1LiO"
}