---
title: "Exchange an emailed sign-in token for a console session. POST-only by design: a scanner prefetching the emailed link consumes nothing."
method: POST
path: "/v1/console/session"
tags: ["console"]
---

# Exchange an emailed sign-in token for a console session. POST-only by design: a scanner prefetching the emailed link consumes nothing.

`POST /v1/console/session`

## Request

- Base URL: `https://api.mapmap.ai`
- URL: `https://api.mapmap.ai/v1/console/session`
- Auth: none declared

## Request body

- SessionExchangeRequest: Body for `POST /v1/console/session`.
  - `token` string, required: The single-use token from the emailed sign-in link.

## Response `200`

Session minted

- SessionResponse: Response for `POST /v1/console/session`.
  - `email` string, required: Delivery email of the identity (the user just proved control of this mailbox).
  - `expires_at` string, required: RFC 3339 session expiry.
  - `session` string, required: The session bearer (`sns_…`). The website stores it in an httpOnly cookie on its own origin; it is never an API credential.

## Other responses

- `401`: Unknown, used or expired sign-in token
- `429`: Per-IP exchange velocity exceeded
- `501`: Console not configured

---

[API](https://skmtc.dev/mapmap/apis/sn-gateway.md) · [All operations](https://skmtc.dev/mapmap/apis/sn-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/mapmap/apis/sn-gateway/revisions/2293be8b4c38?raw)