---
title: "Start an embed session for a form on your website (valid 2 hours)"
method: POST
path: "/api/v1/embed/session"
tags: ["Embed"]
---

# Start an embed session for a form on your website (valid 2 hours)

`POST /api/v1/embed/session`

## Request

- Base URL: `https://philforms.com`
- URL: `https://philforms.com/api/v1/embed/session`
- Auth: one of:
  - none
  - HTTP bearer

From the browser: { site_key } — the Origin header must be one of the key's sites. From your server: your secret key + { origin, customer_ref?, form_id? }. Send the returned token as X-PDFPhile-Embed; it opens the filler only. The SDK (/embed.js) does this for you.

## Request body

- object
  - `site_key` string
  - `origin` string
  - `customer_ref` string
  - `form_id` string

## Response `201`

{ token, origin, expires_at }

## Other responses

- `400`: No site key / no Origin / a secret key sent from a browser
- `401`: Unknown or paused site key, or bad secret key
- `403`: Origin not allowed for this site key

---

[API](https://skmtc.dev/philforms/apis/philforms-api.md) · [All operations](https://skmtc.dev/philforms/apis/philforms-api/llms.txt) · [OpenAPI document](https://skmtc.dev/philforms/apis/philforms-api/revisions/a43bf313729c?raw)