Tokens (eMSP)

Hub roles: Tokens RECEIVER (eMSP → Hub token push) and SENDER (CPO → Hub → eMSP realtime authorize; Hub → CPO token sync). For charger-initiated authorize, implement Tokens SENDER so Hub can forward POST …/authorize to you.

Guide: RFID & Autocharge.

Endpoints

Method	Path	Description
`PUT`	`/ocpi/2.2.1/tokens/{emsp_cc}/{emsp_pid}/{token_uid}`	Push/upsert Token (whitelist / Autocharge)
`PATCH`	`/ocpi/2.2.1/tokens/{emsp_cc}/{emsp_pid}/{token_uid}`	Patch Token
(receive)	CPO → Hub → eMSP `POST …/tokens/{uid}/authorize?type=`	Implement Tokens SENDER for RFID/Autocharge

Remote app start uses Commands (START_SESSION), not Tokens authorize.

Token push (whitelist / Autocharge)

Push Tokens so CPOs can authorize offline (auth_method: WHITELIST):

RFID: type: "RFID", uid = card id
Autocharge: type: "OTHER", uid = normalized MAC/EVCCID; prefer whitelist: ALWAYS or ALLOWED_OFFLINE

Hub stores the Token and fans out to all routed CPOs (FORWARD_TOKEN).

CPO → eMSP authorize (RFID / Autocharge at charger)

When a driver taps RFID or plugs in (Autocharge), the CPO calls Hub; Hub forwards to your Tokens SENDER endpoint:

CPO → Hub: POST /ocpi/2.2.1/tokens/{uid}/authorize?type=RFID
           Headers: OCPI-To = your eMSP party
Hub → eMSP: POST {your_tokens_sender_url}/{uid}/authorize?type=RFID

Respond with full AuthorizationInfo. Prefer setting authorization_reference so sessions/CDRs with a Hub cdr_token can be rewritten under COMPATIBILITY.

Authorization results

Value	Meaning
`ALLOWED`	Token authorized for charging
`BLOCKED`	Token explicitly blocked
`NOT_ALLOWED`	Token not valid at this location, or Hub: not routed / unknown peer
`UNKNOWN`	Hub could not complete authorize (parse HTTP + `status_message`)

Parse HTTP with UNKNOWN

When Hub cannot reach or interpret the peer, the envelope is still OCPI status_code: 1000 with data.allowed: UNKNOWN, but HTTP is 504 (timeout) or 502 (unavailable / incomplete). Hub does not retry authorize.

Rate limit

100 requests/minute per party on the authorize path.

OCPI spec

See OCPI 2.2.1 Tokens module for full Token and AuthorizationInfo objects.