Visitor Auth and Access

Use this guide to understand how visitors authenticate and manage access entitlements.

When to use

• You are a creator setting up protected pages/files and need to understand the visitor experience.
• You are debugging a visitor who cannot access content.
• You are integrating the checkout flow into a custom frontend.

How visitor auth works

Visitors authenticate using passwordless magic links. There are no passwords or usernames.

1. Visitor submits their email.
2. A magic link is sent to that email (valid for 15 minutes).
3. Clicking the link sets a session cookie (_10x_visitor, valid for 30 days).
4. The cookie grants access to visitor access endpoints and entitlement checks.

Page access modes

UI path (buyer perspective)

1. Visitor opens a paid page at https://{handle}.10x.in/{pageSlug}.
2. If payment is required, the visitor enters their email.
3. They click the magic link in their email.
4. After authentication, they are redirected to Stripe checkout.
5. On successful payment, they are redirected back and can access the page.

UI path (creator perspective)

1. Open https://app.10x.in.
2. Navigate to your handle and open the Pages section.
3. Create or edit a page and set the access mode to PAID.
4. Set the price and currency.
5. Ensure your Stripe Connect account is connected (see Revenue settings).

Required auth

• No auth for magic link request and access checks.
• Visitor session cookie for checkout, access list, and group buy interest.
• Creator-level JWT for issuing refunds.

API fallback

Visitor authentication

• POST /v2/visitor/auth/magic-link — request a magic link.

{
  "email": "buyer@example.com"
}

• POST /v2/visitor/auth/verify — verify the token from the magic link. Sets the session cookie.
• GET /v2/visitor/me — get the authenticated visitor profile.
• POST /v2/visitor/auth/logout — clear the session.

Access check

POST /v2/public/pages/{handle}/{pageSlug}/access-check

Returns hasAccess (boolean) and reason (public, visitor_auth_required, entitled, purchase_required).

Checkout

POST /v2/public/pages/{handle}/{pageSlug}/checkout

Requires a visitor session cookie. Returns a Stripe checkout URL. Redirect the visitor to that URL.

{
  "successUrl": "https://example.com/thanks",
  "cancelUrl": "https://example.com/cancelled"
}

View access

GET /v2/visitor/access

Returns the visitor's access history across paid pages, free-login pages, and allowlisted files with resource type, access type, and status.

Refund (creator only)

POST /v2/handles/{handle}/pages/{pageSlug}/refund

{
  "visitorId": "vis_abc123"
}

Initiates a Stripe refund and revokes the visitor's access.

Group buys

Group buys let visitors express interest in a collective purchase. When the target quantity is reached, the creator can activate the offer.

• GET /v2/public/group-buys/{handle}/{groupBuySlug} — view group buy details (public).
• POST /v2/public/group-buys/{handle}/{groupBuySlug}/interest — express interest (visitor session required).
• GET /v2/public/group-buys/{handle}/{groupBuySlug}/my-interest — check own interest status.
• DELETE /v2/public/group-buys/{handle}/{groupBuySlug}/my-interest — withdraw interest.

If you need booking money on current 10x, pair the group-buy with a linked PAID reservation page and a threshold-gated offer. Before the threshold unlocks, paid-page checkout returns offer_not_unlocked; after unlock, the same page can open Stripe checkout for a flat reservation fee. Set requireActiveInterest=true on the offer-to-group-buy link if checkout should stay limited to visitors with active interest. Use Kashmir Apples Reservation-Fee Group Buy for the full creator and buyer workflow.

Common errors

Entitlement logic

A visitor has access to a paid page when:

• A purchase record exists for that visitor and page.
• The grant type is not REFUNDED.
• The access has not been revoked.

If a refund is issued (by the creator or via Stripe), the entitlement is revoked and the visitor loses access.

Related:

• Getting Started
• API Auth and Error Model
• Troubleshooting and Support