Skip to main content
POST
Mint a user session token

Authorizations

Authorization
string
header
required

Project-scoped secret API key (sk_…). Pass in the Authorization: Bearer <key> header. Grants access to the project the key was issued for.

Path Parameters

userId
string
required

Numeric ID (admin scope) or user external_id (project scope) — the route resolves both.

Example:

"cust-9f4b21"

Response

A new user session token.

A short-lived user session token. Tokens are bound to one project and one user, expire after 15 minutes, and are not refreshable.

token
string
required

Short-lived signed token that scopes subsequent calls to this user. Pass in the X-Spotzee-User-Token header alongside a publishable key (pk_…) to call the preference-centre endpoints. Treat as bearer credentials — never log or persist.

Example:

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

expires_at
string | null
required

Token expiry. ISO 8601. Tokens are not refreshable — issue a new one when expired.

Example:

"2026-04-29T18:30:00.000Z"