---
title: "Exchange an API key for an httpOnly dashboard session cookie."
method: POST
path: "/dashboard/session"
tags: ["dashboard"]
---

# Exchange an API key for an httpOnly dashboard session cookie.

`POST /dashboard/session`

## Request

- Base URL: `https://api.coldrig.dev`
- URL: `https://api.coldrig.dev/dashboard/session`
- Auth: none required

Unauthenticated (there is no Authorization header at this point in the flow) — the pasted API key travels in the JSON body instead and is verified here via the same resolver `requireAuth` uses. On success, sets an httpOnly/Secure/SameSite=Strict session cookie; the SPA never sees the bearer token or the session id in JS-readable storage. The request must carry the header `X-Coldstart-Client: dashboard`; without it the call is refused with 403 and the token is not checked.

## Headers

- `X-Coldstart-Client` 'dashboard', required

## Request body

- DashboardSessionInput
  - `token` string, required: The API key from POST /signup.

## Response `200`

Session cookie set.

- object
  - `tenantId` string, required

## Other responses

- `401`: Missing, invalid, or inactive bearer token.
- `403`: The `X-Coldstart-Client: dashboard` header is missing.

---

[API](https://skmtc.dev/coldrig/apis/agent-cold-email-api.md) · [All operations](https://skmtc.dev/coldrig/apis/agent-cold-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/coldrig/apis/agent-cold-email-api/revisions/242a462d82c4?raw)