Issue a one-use editor bootstrap session

Call from the customer server with a full server API key and an already registered exact parent origin. Derive subject from your authenticated end user. The response includes bootstrap_secret once and expires_at; mode inherits the persisted key. Never expose the server API key to the host page. The session is subject scoped; caller headers cannot forge this identity.

post/embed/sessions

Request

  • Base URL: https://rendry.io/api/v1
  • URL: https://rendry.io/api/v1/embed/sessions
  • Auth: HTTP bearer

Headers

X-Rendry-Accountstring

Browser/OAuth current member account selector. API keys/embed credentials are bound to their persisted account and reject another account. Omitting this header selects the browser actor personal account.

Request body

subjectstring required
parent_originstring required
role'editor' | 'viewer'

Response

Issue a one-use editor bootstrap session

idstring required
account_idstring required
actor_idstring required
subjectstring required
parent_originstring required
mode'live' | 'test' required
role'editor' | 'viewer' required
expires_atstring date-time required
bootstrap_secretstring

Only in issue response; one-use secret delivered by the customer server to its authenticated host page in memory.

tokenstring

Only in redeem response; em_... credential for the same-origin editor child.

Changes

No recorded changes to this operation across all 1 revision of this API.