---
title: "Redeem a one-use bootstrap secret"
method: POST
path: "/embed/sessions/{session}/redeem"
---

# Redeem a one-use bootstrap secret

`POST /embed/sessions/{session}/redeem`

## Request

- Base URL: `https://rendry.io/api/v1`
- URL: `https://rendry.io/api/v1/embed/sessions/{session}/redeem`
- Auth: none required

Used by the origin-restricted wrapper after exact-origin/source/nonce handshake. Redeem once; expired, revoked or already redeemed sessions are refused. Replies are no-store. Customer applications normally use the browser mount helper.

## Path parameters

- `session` string, required

## Request body

- object
  - `bootstrap_secret` string, required

## Response `200`

Redeem a one-use bootstrap secret

- EmbedSession
  - `id` string, required
  - `account_id` string, required
  - `actor_id` string, required
  - `subject` string, required
  - `parent_origin` string, required
  - `mode` 'live' | 'test', required
  - `role` 'editor' | 'viewer', required
  - `expires_at` string, date-time, required
  - `bootstrap_secret` string: Only in issue response; one-use secret delivered by the customer server to its authenticated host page in memory.
  - `token` string: Only in redeem response; em_... credential for the same-origin editor child.

## Other responses

- `400`: Typed refusal with a stable error code.
- `401`: Typed refusal with a stable error code.
- `403`: Typed refusal with a stable error code.
- `404`: Typed refusal with a stable error code.
- `409`: Typed refusal with a stable error code.
- `429`: Typed refusal with a stable error code.

---

[API](https://skmtc.dev/rendry/apis/rendry-api.md) · [All operations](https://skmtc.dev/rendry/apis/rendry-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rendry/apis/rendry-api/revisions/c4fb572c26c9?raw)