# Create session token

> Source: https://truto.one/docs/api-reference/admin/session-tokens/create/

`POST /session-token`

Resource: **Session tokens**

## Request body

- **`tenant_id`** _(string)_
  The tenant this session is scoped to. The tenant must already exist in the environment unless `create_tenant_if_missing` is true.
- **`environment_id`** _(string)_
  The environment the tenant belongs to. Required for user-session auth. Defaults to the API token's own environment for API-token auth.
- **`expires_in`** _(integer)_
  Seconds until the token expires. Clamped to `max_lifetime` when that is smaller.
- **`is_refreshable`** _(boolean)_
  Whether `POST /session-token/renew` may slide this token forward. A non-refreshable session must be re-minted instead.
- **`max_lifetime`** _(integer)_
  Seconds from issue until the absolute ceiling on this session. Renewal can never extend past it.
- **`allowed_origins`** _(array<string>)_
  Narrows the environment's allowed origins for this session only. Intersected with the environment's list — entries it does not already allow are dropped. Omit to inherit the environment's list.
- **`create_tenant_if_missing`** _(boolean)_
  Create the tenant when it does not exist yet, instead of failing with `404`. Useful for first-run customers whose tenant row has not materialized.

## Response body

- **`session_token`** _(string)_
  The session token. Send it in the `Authorization` header as a bearer token.
- **`expires_at`** _(string)_
  When this token stops authenticating unless it is renewed.
- **`max_lifetime_at`** _(string)_
  The absolute ceiling. No renewal can carry the session past this.

## Code examples

### curl

```bash
curl -X POST 'https://api.truto.one/session-token' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "tenant_id": "acme-1",
  "environment_id": "8a2b104d-74a6-47f2-b93e-c6b611e82391",
  "expires_in": 900,
  "is_refreshable": true,
  "max_lifetime": 43200,
  "allowed_origins": [
    "https://app.acme.com"
  ],
  "create_tenant_if_missing": false
}'
```

### JavaScript

```javascript
const body = {
  "tenant_id": "acme-1",
  "environment_id": "8a2b104d-74a6-47f2-b93e-c6b611e82391",
  "expires_in": 900,
  "is_refreshable": true,
  "max_lifetime": 43200,
  "allowed_origins": [
    "https://app.acme.com"
  ],
  "create_tenant_if_missing": false
};

const response = await fetch('https://api.truto.one/session-token', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
```

### Python

```python
import requests

url = "https://api.truto.one/session-token"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
}
payload = {
    "tenant_id": "acme-1",
    "environment_id": "8a2b104d-74a6-47f2-b93e-c6b611e82391",
    "expires_in": 900,
    "is_refreshable": True,
    "max_lifetime": 43200,
    "allowed_origins": [
        "https://app.acme.com"
    ],
    "create_tenant_if_missing": False
}

response = requests.post(url, headers=headers, params=params, json=payload)
print(response.json())
```