---
title: "Issue a one-use editor bootstrap session"
method: POST
path: "/embed/sessions"
---

# Issue a one-use editor bootstrap session

`POST /embed/sessions`

## Request

- Base URL: `https://rendry.io/api/v1`
- URL: `https://rendry.io/api/v1/embed/sessions`
- Auth: HTTP bearer

Call from the customer server with a full server API key and an already registered exact parent origin. Derive subject from your authenticated end user. The response includes bootstrap_secret once and expires_at; mode inherits the persisted key. Never expose the server API key to the host page. The session is subject scoped; caller headers cannot forge this identity.

## Headers

- `X-Rendry-Account` string

## Request body

- object
  - `subject` string, required
  - `parent_origin` string, required
  - `role` 'editor' | 'viewer'

## Response `201`

Issue a one-use editor bootstrap session

- EmbedSession
  - `id` string, required
  - `account_id` string, required
  - `actor_id` string, required
  - `subject` string, required
  - `parent_origin` string, required
  - `mode` 'live' | 'test', required
  - `role` 'editor' | 'viewer', required
  - `expires_at` string, date-time, required
  - `bootstrap_secret` string: Only in issue response; one-use secret delivered by the customer server to its authenticated host page in memory.
  - `token` string: Only in redeem response; em_... credential for the same-origin editor child.

## Other responses

- `400`: Typed refusal with a stable error code.
- `401`: Typed refusal with a stable error code.
- `403`: Typed refusal with a stable error code.
- `404`: Typed refusal with a stable error code.
- `409`: Typed refusal with a stable error code.
- `429`: Typed refusal with a stable error code.

---

[API](https://skmtc.dev/rendry/apis/rendry-api.md) · [All operations](https://skmtc.dev/rendry/apis/rendry-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rendry/apis/rendry-api/revisions/c4fb572c26c9?raw)