---
title: "Bootstrap a hidden auth session for MCP consent"
method: POST
path: "/v1/users/connect-sessions/{session_id}/auth-session"
tags: ["Users"]
---

# Bootstrap a hidden auth session for MCP consent

`POST /v1/users/connect-sessions/{session_id}/auth-session`

## Request

- Base URL: `http://0.0.0.0:3000`
- URL: `http://0.0.0.0:3000/v1/users/connect-sessions/{session_id}/auth-session`
- Auth: none declared

Creates or reuses a hidden Supabase auth identity for the durable connect session and returns a one-time token hash that the browser can verify into a session without showing an Attrove sign-in screen.

## Path parameters

- `session_id` string, uuid, required

## Response `200`

Default Response

- object
  - `success` true, required
  - `data` object, required
    - `session_id` string, uuid, required
    - `user_id` string, uuid, required
    - `token_hash` string, required
    - `type` 'magiclink', required
    - `display_email` string, required

## Other responses

- `404`: Default Response
- `410`: Default Response
- `429`: Default Response
- `500`: Default Response

---

[API](https://skmtc.dev/attrove/apis/attrove-api.md) · [All operations](https://skmtc.dev/attrove/apis/attrove-api/llms.txt) · [OpenAPI document](https://skmtc.dev/attrove/apis/attrove-api/revisions/fcdc818b45cb?raw)