---
title: "Redeem a grant for the credential it authorised. Takes the browser session token and the bridge credential, and refuses an agent principal — the agent asks which binding, the bridge collects the answer."
method: POST
path: "/v1/agents/{id}/browser/fills/consume"
tags: ["Browser Bridge"]
---

# Redeem a grant for the credential it authorised. Takes the browser session token and the bridge credential, and refuses an agent principal — the agent asks which binding, the bridge collects the answer.

`POST /v1/agents/{id}/browser/fills/consume`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/agents/{id}/browser/fills/consume`
- Auth: HTTP bearer

## Headers

- `x-1claw-bridge-credential` string, required
- `x-1claw-bridge-session` string, required
- `x-1claw-bridge-version` string, required

## Request body

- object
  - `session_id` string, uuid, required
  - `grant_id` string, uuid, required
  - `generation` integer, required: The bridge's navigation counter now. A mismatch means the page moved after the decision.

## Response `200`

The credential itself, as raw bytes — the only route in the feature that returns secret material. Not a JSON envelope: the bridge adopts the body into a zeroable buffer, and a wrapper would force it to parse, interning the secret as a string that lives until GC. Metadata rides in `x-1claw-binding-id` and `x-1claw-form-fingerprint`; the response is `cache-control: no-store`.

## Other responses

- `400`: Missing or unsupported bridge version
- `403`: Grant expired, already used, issued to another session or device; the page navigated after authorisation; or an agent principal was presented
- `404`: The binding or the secret behind it is missing

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)