Skip to main content

Exchange a local recovery token or username/password for an opaque session

POST 
/api/v1/session

The recovery token or password is accepted only in this JSON body and is never persisted by the session store. Browser requests are subject to same-origin Fetch Metadata and Origin checks. The returned credential is set as a host-only HttpOnly SameSite=Strict cookie.

Request​

Responses​

Authenticated and session cookie issued

Response Headers
    Cache-Control

    Always no-store for credential responses

    Set-Cookie

    Opaque host-only HttpOnly SameSite=Strict Jiandu session cookie

    X-Request-Id

    Opaque request correlation identifier. ProblemDetails.requestId carries the same value on JSON failures.

Last updated on