---
title: "Create a session cookie"
method: POST
path: "/api/auth/session"
tags: ["auth"]
---

# Create a session cookie

`POST /api/auth/session`

[cloud-only] Creates a session cookie from the bearer token in the Authorization header. Returns a Set-Cookie header with a secure HttpOnly session cookie. Cookie authentication is not allowed for this endpoint.

## Response `200`

Session created

- CreateSessionResponse — [cloud-only] Response after creating a session cookie.
  - `success` boolean, required
  - `expiresIn` integer — Session expiration time in seconds.

## Other responses

- `400` — Bad request — invalid or expired ID token
- `401` — Unauthorized
- `500` — Internal server error

## Changes

- **2026-05-22** `09a5075587c8` — 2 info
  - api operation id `createAuthSession` removed and replaced with `createSession`
  - added the non-success response with the status `500`
- **2026-05-08** `c9640fded659` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/comfy-org/apis/comfyui-api/changes/api/auth/session/post.md)

---

[API](https://skmtc.dev/comfy-org/apis/comfyui-api.md) · [All operations](https://skmtc.dev/comfy-org/apis/comfyui-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/comfy-org/comfyui-api/revisions/09a5075587c8/schema)