Skip to main content
POST
Create session

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

id
string
required

Device id (dev_<uuid>)

Body

application/json
mode
string | null

watch (frames only) or control (frames + input + takeover). Defaults to watch — the less-privileged of the two, so an omitted field can never accidentally mint control.

ttl_secs
integer<int64> | null

Requested lifetime in seconds. Clamped to the server's allowed band; a client does not get to decide how long a live-browser capability lives.

Response

The minted session (token shown once)

A minted session. session_token is returned EXACTLY ONCE — only its SHA-256 is stored.

device_id
string
required
expires_at
string
required
id
string
required

ses_<uuid>.

mode
string
required
object
string
required

Discriminator for polymorphic SDK decoders. Always "session".

session_token
string
required

Present only on the mint response.

ws_url
string
required

The BACKEND gateway to connect to. Never the sprite: the sprite's origin and viewer token stay inside the API process.