To hand a user to the Scanifly mobile app, exchange your token for a native Scanifly session:
POST /auth/reseller/exchange
{ "token": "<your RS256 JWT>" }The response contains an access/refresh pair the app can hold and refresh on its own, which
matters because the app cannot refresh a token you signed.
A token used here must be short-lived: no more than 120 seconds between iat and exp
(with 30 seconds of clock-skew tolerance), and its iat cannot be in the future. Mint a
dedicated short token for the handoff rather than reusing a long-lived iFrame token. The token
is single-use — a second exchange with the same token is rejected.
Automatic user creation works here too, under the same conditions.