> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.withpersona.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.withpersona.com/_mcp/server. # Create a Privacy Pass POST https://api.withpersona.com/api/v1/privacy-passes Content-Type: application/json Issues a Privacy Pass token by blind-signing a client-provided blinded token (Blind RSA, RFC 9578). The returned blind signature is unblinded client-side to produce a Privacy Pass token that can later be redeemed anonymously (for example, when generating a Relay claim). Reference: https://docs.withpersona.com/api-reference/relay/create-a-privacy-pass ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Request ### Headers - `Key-Inflection` (enum, optional) — Determines casing for the API response. - Allowed values: `camel`, `kebab`, `snake` - `Idempotency-Key` (string, optional) — Ensures the request is idempotent. - `Persona-Version` (enum, optional) — Server API version. More info on versioning can be found [here](https://docs.withpersona.com/versioning). - Allowed values: `2025-12-08`, `2025-10-27`, `2023-01-05`, `2022-09-01`, `2021-08-18`, `2021-07-05`, `2021-02-21`, `2020-05-18` ### Body (application/json) This endpoint expects an object. - `blinded-token` (string, required) — The base64url-encoded blinded token to be signed. Produced client-side by blinding a token input with the issuer public key identified by `key-id`. - `key-id` (string, required) — The hex-encoded identifier of the issuer signing key to use. Must match the key the `blinded-token` was blinded against. ## Response ### 201 Returns the blind signature for the submitted blinded token. - `blind-sig` (string, required) — The base64url-encoded blind signature. Unblind this client-side to produce the Privacy Pass token. ## Errors ### 400 Bad Request Error The request was unacceptable, often due to invalid parameters. - `errors` (list of PrivacyPassesPostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 401 Unauthorized Error An invalid API key was provided. - `errors` (list of PrivacyPassesPostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 403 Forbidden Error The given API key doesn’t have permissions to perform the request or a quota has been exceeded. - `errors` (list of PrivacyPassesPostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 404 Not Found Error The requested resource doesn’t exist. - `errors` (list of PrivacyPassesPostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 409 Conflict Error The request conflicts with another request, often due to attempting to create a duplicate resource. - `errors` (list of PrivacyPassesPostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 422 Unprocessable Entity Error The request modifies the resource in an unacceptable way, often due to an invalid action or parameter. - `errors` (list of PrivacyPassesPostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 429 Too Many Requests Error Your organization’s rate limit has been exceeded. We recommend an exponential backoff on requests. - `errors` (list of PrivacyPassesPostResponsesContentApplicationJsonSchemaErrorsItems, optional) ## Types ### PrivacyPassesPostResponsesContentApplicationJsonSchemaErrorsItems - `title` (string, optional) - `details` (string, optional) ## Examples **Request** ```json { "blinded-token": "5rT2pX9qLkV0nW3bYc7dZ1aF8gH4jK6mN2pQ5rS8tU", "key-id": "a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c" } ``` **Response** ```json { "blind-sig": "kR9mP2xQ7vL0nW3bYc8dZ4aF1gH6jK5mN8pQ2rS7tU" } ``` **SDK Code** ```python Created import requests url = "https://api.withpersona.com/api/v1/privacy-passes" payload = { "blinded-token": "5rT2pX9qLkV0nW3bYc7dZ1aF8gH4jK6mN2pQ5rS8tU", "key-id": "a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c" } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript Created const url = 'https://api.withpersona.com/api/v1/privacy-passes'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"blinded-token":"5rT2pX9qLkV0nW3bYc7dZ1aF8gH4jK6mN2pQ5rS8tU","key-id":"a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Created package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://api.withpersona.com/api/v1/privacy-passes" payload := strings.NewReader("{\n \"blinded-token\": \"5rT2pX9qLkV0nW3bYc7dZ1aF8gH4jK6mN2pQ5rS8tU\",\n \"key-id\": \"a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c\"\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Created require 'uri' require 'net/http' url = URI("https://api.withpersona.com/api/v1/privacy-passes") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"blinded-token\": \"5rT2pX9qLkV0nW3bYc7dZ1aF8gH4jK6mN2pQ5rS8tU\",\n \"key-id\": \"a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c\"\n}" response = http.request(request) puts response.read_body ``` ```java Created import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://api.withpersona.com/api/v1/privacy-passes") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"blinded-token\": \"5rT2pX9qLkV0nW3bYc7dZ1aF8gH4jK6mN2pQ5rS8tU\",\n \"key-id\": \"a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c\"\n}") .asString(); ``` ```php Created request('POST', 'https://api.withpersona.com/api/v1/privacy-passes', [ 'body' => '{ "blinded-token": "5rT2pX9qLkV0nW3bYc7dZ1aF8gH4jK6mN2pQ5rS8tU", "key-id": "a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c" }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp Created using RestSharp; var client = new RestClient("https://api.withpersona.com/api/v1/privacy-passes"); var request = new RestRequest(Method.POST); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"blinded-token\": \"5rT2pX9qLkV0nW3bYc7dZ1aF8gH4jK6mN2pQ5rS8tU\",\n \"key-id\": \"a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c\"\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift Created import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [ "blinded-token": "5rT2pX9qLkV0nW3bYc7dZ1aF8gH4jK6mN2pQ5rS8tU", "key-id": "a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c" ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://api.withpersona.com/api/v1/privacy-passes")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```