Exchange session token

Exchange a short-lived session token for a long-lived browser session.

This endpoint is unauthenticated. The session token itself serves as proof of authorization. Each token can only be exchanged once; subsequent attempts return 401.

The returned browser session token is valid for 24 hours and should be stored as an httpOnly cookie or used in the Authorization header for subsequent API calls.

POST /v2/portal.exchangeSession

Typescript (SDK)

TypeScript

import { Unkey } from "@unkey/api";

const unkey = new Unkey();

async function run() {
  const result = await unkey.portal.exchangeSession({
    sessionId: "pst_abc123def456",
  });

  console.log(result);
}

run();

200

{
  "meta": {
    "requestId": "req_123"
  },
  "data": {
    "token": "ps_xyz789abc123",
    "expiresAt": 1711386400000
  }
}

Body

application/json

sessionId · string · required

The session token ID received from portal.createSession. Must be valid, unexpired, and not previously exchanged.

Minimum string length: 1

Example:

"pst_abc123def456"

Response

200

application/json

Session exchanged successfully. Use the returned token for subsequent API calls.

meta · object · required

Metadata object included in every API response. This provides context about the request and is essential for debugging, audit trails, and support inquiries. The requestId is particularly important when troubleshooting issues with the Unkey support team.

Show child attributes

data · object · required

Show child attributes