---
title: "Mint a browser-safe token for the embeddable widget."
method: POST
path: "/v1/domains/{id}/connect-session"
tags: ["Domains"]
---

# Mint a browser-safe token for the embeddable widget.

`POST /v1/domains/{id}/connect-session`

## Request

- Base URL: `https://api.domainee.dev`
- URL: `https://api.domainee.dev/v1/domains/{id}/connect-session`
- Auth: HTTP bearer

Returns a short-lived token scoped to this one domain, safe to hand to a browser. Call it from your server with your API key, then pass the token to Domainee.mount(). The token can only read the domain, read its connect instructions, force a DNS check, and apply records with a customer-supplied DNS token; everything else returns 403, including other domains and minting another session. Tokens are signed rather than stored, so they cannot be revoked before expiry: keep ttlSeconds short. Default 3600, maximum 86400. Never send an sk_live_ key to a browser.

## Request body

- object
  - `ttlSeconds` integer

## Response `200`

A scoped, short-lived widget token.

- object
  - `connectSession` object
    - `token` string
    - `expiresAt` string, date-time
    - `domainId` string
    - `hostname` string

## Other responses

- `401`: Missing, malformed, revoked, or expired Bearer token.
- `404`: No such object in this workspace.

---

[API](https://skmtc.dev/domainee/apis/domainee-api.md) · [All operations](https://skmtc.dev/domainee/apis/domainee-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domainee/apis/domainee-api/revisions/756d54434372?raw)