# Quickstart

Connect one customer end to end on staging. Replace the placeholders with your staging credentials.

## 1. Get a partner JWT

```bash
curl -X POST https://staging-api.getmcard.com/v1/partners/auth \
  -H "Content-Type: application/json" \
  -d '{"client_id": "pk_yourcompany", "client_secret": "sk_..."}'
```

```json
{
  "error": null,
  "message": "Authentication successful",
  "data": {
    "access_token": "eyJhbGciOi...",
    "token_type": "bearer",
    "expires_in": 3600,
    "partner_id": "3d776894-8658-805d-9c11-dd9f326891a1",
    "slug": "yourcompany"
  }
}
```

Send `data.access_token` as `Authorization: Bearer <token>` on every other call. Request a new one before `expires_in` runs out.

## 2. Start a link session

```bash
curl -X POST https://staging-api.getmcard.com/v1/partners/link/sessions \
  -H "Authorization: Bearer $PARTNER_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "apply",
    "prefill": {
      "first_name": "Ada",
      "last_name": "Lovelace",
      "email": "ada@example.com",
      "address_line_1": "1 Main St",
      "city": "Virginia Beach",
      "state": "VA",
      "zipcode": "23451"
    },
    "lock_fields": ["first_name", "last_name", "email", "address"]
  }'
```

The response is HTTP 201 and contains `link_url`. It expires in 60 minutes.

## 3. Open it in the browser

```html
<script src="https://staging-app.madecard.com/sdk/v1/made-link.js"></script>
<button id="apply" disabled>Apply for Made Card</button>
<script>
  const button = document.getElementById("apply");
  let made;
  fetch("/made/link-session", { method: "POST" })
    .then((r) => r.json())
    .then(({ link_url }) => {
      made = MadeLink.create({
        linkUrl: link_url,
        onSuccess: (publicToken) =>
          fetch("/made/exchange", {
            method: "POST",
            headers: { "Content-Type": "application/json" },
            body: JSON.stringify({ public_token: publicToken }),
          }),
        onExit: (error) => console.log("Made Link ended:", error ? error.code : "closed by the customer"),
      });
      button.disabled = false;
    });
  button.addEventListener("click", () => made.open());
</script>
```

`/made/link-session` and `/made/exchange` are routes on your own server. The browser never sees your partner JWT, `client_secret`, or the customer `access_token`. The session is created before the click so `open()` runs inside the click handler, where browsers allow new windows. The Web SDK page has the full example.

## 4. Exchange the public token

```bash
curl -X POST https://staging-api.getmcard.com/v1/partners/link/token \
  -H "Authorization: Bearer $PARTNER_JWT" \
  -H "Content-Type: application/json" \
  -d '{"public_token": "public_..."}'
```

Store `data.access_token` (`link_...`) and `data.user_id` against your own customer record.

## 5. Open Made Card on a later visit

```bash
curl -X POST https://staging-api.getmcard.com/v1/partners/sessions/launch \
  -H "Authorization: Bearer $PARTNER_JWT" \
  -H "Content-Type: application/json" \
  -d '{"access_token": "link_...", "target_path": "/dashboard/home"}'
```

The response is HTTP 201. Open `data.launch_url` within 5 minutes, for example with `MadeLink.openLaunchUrl(launch_url)`. The customer lands in Made Card already signed in.