---
title: "Pair"
method: POST
path: "/v1/in-context/pair"
tags: ["in-context"]
---

# Pair

`POST /v1/in-context/pair`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/in-context/pair`
- Auth: none declared

App claims a pairing token OR short code → scoped, expiring Centrifugo
sub-token.

Accepts EITHER the long QR token or the short human-typable code (task 929)
in the same `pairingToken` field — matched case-insensitively with the
hyphen/whitespace ignored. Single-use + bound: the claim is an atomic
conditional update on the unused session, so a replay (or a race) cannot
pair twice. Rejects unknown credentials, inactive sessions, and expired
sessions. Brute-force protected: failed (unknown) attempts per client IP are
rate-limited with a lockout, which is what makes the short code safe.

## Request body

- PairIn
  - `pairing_token` string, required
  - `device` string, nullable

## Response `200`

Successful Response

- PairOut
  - `token` string, required
  - `channel` string, required
  - `rtUrl` string, required
  - `expiresAt` integer, required
  - `sessionId` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)