Skip to main content
POST
Mint a session token for a browser or app user.

Authorizations

Authorization
string
header
required

Send an API key, or a session token a key minted, as Authorization: Bearer <credential>. A browser opening /v1/stream offers its session token in Sec-WebSocket-Protocol instead.

Body

application/json

The body of POST /v1/session-tokens.

origins
string[]
required

The origins the token may be presented from, 1 to 10, each as a browser sends Origin.

Required array length: 1 - 10 elements
Example:
subject
string | null

Who the token is for, in the caller's own terms: at most 128 characters, no control characters.

Maximum string length: 128
Example:

"user-42"

ttlSeconds
integer<int32> | null

How long the token lives, 60 to 3600 seconds; 900 when absent.

Required range: 60 <= x <= 3600
Example:

900

Response

The token, and when it expires. Present it as Authorization: Bearer <token>, or on the stream handshake in Sec-WebSocket-Protocol beside metastreams.v1, from one of its origins.

A session token as the mint answers it.

expiresAt
integer<int64>
required

When it stops authenticating.

token
string
required

The token, presented as Authorization: Bearer <token>, or on the stream handshake in Sec-WebSocket-Protocol.