Create session token

POST /session-token

Request Body

allowed_originsstring[]

Narrows the environment's allowed origins for this session only. Intersected with the environment's list — entries it does not already allow are dropped. Omit to inherit the environment's list.

Example: ["https://app.acme.com"]

create_tenant_if_missingboolean

Create the tenant when it does not exist yet, instead of failing with 404. Useful for first-run customers whose tenant row has not materialized.

Example: false

environment_idstring · uuid

The environment the tenant belongs to. Required for user-session auth. Defaults to the API token's own environment for API-token auth.

Example: 8a2b104d-74a6-47f2-b93e-c6b611e82391

expires_ininteger

Seconds until the token expires. Clamped to max_lifetime when that is smaller.

Example: 900

is_refreshableboolean

Whether POST /session-token/renew may slide this token forward. A non-refreshable session must be re-minted instead.

Example: true

max_lifetimeinteger

Seconds from issue until the absolute ceiling on this session. Renewal can never extend past it.

Example: 43200

tenant_idstring

The tenant this session is scoped to. The tenant must already exist in the environment unless create_tenant_if_missing is true.

Example: acme-1

Response Body

expires_atstring · date-time

When this token stops authenticating unless it is renewed.

Example: 2026-07-28T11:45:00.000Z

max_lifetime_atstring · date-time

The absolute ceiling. No renewal can carry the session past this.

Example: 2026-07-28T23:30:00.000Z

session_tokenstring · uuid

The session token. Send it in the Authorization header as a bearer token.

Example: 1ba1f401-7183-47c5-9e39-e8e257e3c795

curl -X POST 'https://api.truto.one/session-token' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "tenant_id": "acme-1",
  "environment_id": "8a2b104d-74a6-47f2-b93e-c6b611e82391",
  "expires_in": 900,
  "is_refreshable": true,
  "max_lifetime": 43200,
  "allowed_origins": [
    "https://app.acme.com"
  ],
  "create_tenant_if_missing": false
}'

const body = {
  "tenant_id": "acme-1",
  "environment_id": "8a2b104d-74a6-47f2-b93e-c6b611e82391",
  "expires_in": 900,
  "is_refreshable": true,
  "max_lifetime": 43200,
  "allowed_origins": [
    "https://app.acme.com"
  ],
  "create_tenant_if_missing": false
};

const response = await fetch('https://api.truto.one/session-token', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);

import requests

url = "https://api.truto.one/session-token"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
}
payload = {
    "tenant_id": "acme-1",
    "environment_id": "8a2b104d-74a6-47f2-b93e-c6b611e82391",
    "expires_in": 900,
    "is_refreshable": True,
    "max_lifetime": 43200,
    "allowed_origins": [
        "https://app.acme.com"
    ],
    "create_tenant_if_missing": False
}

response = requests.post(url, headers=headers, params=params, json=payload)
print(response.json())