---
title: "Mint a deterministic tenant test session"
method: POST
path: "/auth/v1/test-sessions"
tags: ["Auth"]
---

# Mint a deterministic tenant test session

`POST /auth/v1/test-sessions`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/v1/test-sessions`
- Auth: API key in header `apikey` and HTTP bearer

Service-key-only helper for tests and CI. Creates or reuses a watermarked `.test.invalid` tenant user derived from `label`, returns a 2-hour browser-session cookie value and a 2-hour bearer access token, and marks actor context with `isTest`.

## Request body

- object
  - `label` string, required: Deterministic local label. The email becomes <label>@<project_id>.test.invalid.
  - `is_admin` boolean
  - `email_verified` boolean
  - `amr` string[]: Requested assurance methods. The platform always adds test_session; passkey creates an internal synthetic passkey for test-only elevation.
  - `auth_time_age_seconds` number
  - `amr_ages_seconds` object
  - `identities` object[]
    - `provider` string, required
    - `subject` string

## Response `201`

Watermarked test session bundle

- AuthTestSessionResponse
  - `user` AuthTestUser, required
    - `id` string, uuid, required
    - `label` string, required
    - `email` string, email, required
    - `is_test` true, required
    - `is_admin` boolean, required
    - `created` boolean: Present on POST /auth/v1/test-sessions to distinguish create vs reuse.
    - `created_at` string, date-time, required
    - `email_verified_at` string, date-time, nullable
    - `last_minted_at` string, date-time, nullable
    - `active_sessions` integer
  - `session` object, required
    - `cookie_name` string, required
    - `cookie_value` string, required: Secret-bearing cookie value. Returned once; do not log.
    - `session_id` string, required
    - `amr` string[], required
    - `auth_time` string, date-time, required
    - `expires_at` string, date-time, required
    - `hard_expires_at` string, date-time, required
  - `access_token` string, required: 2-hour bearer token with is_test=true. No refresh token is issued.
  - `token_type` 'bearer', required
  - `expires_in` integer, required
  - `app_origins` string[], required
  - `examples` object, required
    - `ssr` string
    - `rest` string
  - `test_mode` TestModeStatus, required
    - `value` boolean, nullable, required: Stored project override. null means use the tier default.
    - `effective` boolean, required: Whether test sessions are currently enabled.
    - `source` 'explicit' | 'tier_default', required
    - `default_for_tier` boolean, required: Tier default before the project override is applied.

## Other responses

- `400`: Invalid test-session request
- `403`: Service key required or test mode disabled
- `409`: Test user limit reached or identity conflict

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)