Button token

/api/v1/buton-token — POST

POST/api/v1/buton-token

Called from your server with the secret key. tetikleyen is your own user who opened the page; hedef is the cart (sepet_id), order (siparis_no) or customer phone (musteri_telefon; only its hash goes into the token) to call — exactly one of them. The token is valid for at most 15 minutes (600 s by default), is good for one call request and is printed into the page as data-token.

• Authentication: Authorization: Bearer rz_live_…
• Scope: calls:write
• Plan feature: Call-me button — if off, the endpoint answers 404 not_found
• Idempotency-Key: optional (recommended for retries)

Request body (application/json)

Fields marked * are required. Unknown fields are rejected with 422.

ButtonTokenIn

Field	Type	Limits	Meaning
tetikleyen *	TriggererIn		Your own user who opened the page.
hedef *	ButtonTarget		Target to call (exactly one).
gecerlilik_sn	integer	≥ 60, ≤ 900, default 600	Validity (seconds).

TriggererIn

Field	Type	Limits	Meaning
ad *	string	min 1, max 120	Name.
eposta	string | null	max 200	Email.

ButtonTarget

Field	Type	Limits	Meaning
sepet_id	string | null	min 1, max 200	Cart dis_id.
siparis_no	string | null	min 1, max 64	Order number.
musteri_telefon	string | null	min 10, max 32	Customer phone (only its hash is kept).

Example

curl -s -X POST "$RZ_API/api/v1/buton-token" -H "Authorization: Bearer $RZ_KEY" -H "Content-Type: application/json" \
  -d '{"tetikleyen": {"ad": "Can Demir", "eposta": "[email protected]"},
       "hedef": {"sepet_id": "sepet-7f3a9c"}, "gecerlilik_sn": 600}'

Response 200

{
  "token": "eyJ2Ijox…",
  "son_gecerlilik": "2026-09-27T10:25:00Z"
}

Error statuses: 401, 403, 404, 413, 422, 429 — see Errors and limits.