---
title: "Create session"
method: POST
path: "/widgets/payment/sessions"
tags: ["Payment"]
---

# Create session

`POST /widgets/payment/sessions`

## Request

- Base URL: `https://api.enterprise.sandbox.uphold.com`
- URL: `https://api.enterprise.sandbox.uphold.com/widgets/payment/sessions`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `/core/oauth2/token` scopes: `widgets.payment.sessions:create`
- TypeScript: <https://skmtc.dev/uphold/apis/widget-api/docs/widgets/payment/sessions/post.ts> (a function with typed inputs; its response is checked against the schema)

Create a new session for the Payment Widget.

## Headers

- `X-On-Behalf-Of` string
- `X-Uphold-User-Ip` union
  - string, ipv4
  - string, ipv6
- `X-Uphold-User-Agent` string
- `X-Uphold-User-Origin` string
- `X-Uphold-User-Country` string
- `X-Uphold-User-Subdivision` string
- `X-Uphold-User-City` string

## Request body

- union
  - object
    - `flow` 'select-for-deposit', required: The flow of the payment widget session.
    - `options` object: Additional options for the widget session.
  - object
    - `flow` 'select-for-withdrawal', required: The flow of the payment widget session.
    - `options` object: Additional options for the widget session.
  - object
    - `flow` 'authorize', required: The flow of the payment widget session.
    - `data` object, required: The data for the authorize flow.
      - `quoteId` string, uuid, required: The quote ID to authorize.
    - `options` object: Additional options for the widget session.
  - object
    - `flow` 'deposit', required: The flow of the payment widget session.
    - `options` object: Additional options for the deposit flow.
  - object
    - `flow` 'withdrawal', required: The flow of the payment widget session.
    - `options` object: Additional options for the widget session.

## Response `201`

Session created.

- object
  - `session` PaymentWidgetSession, required
    - `flow` 'authorize' | 'select-for-deposit' | 'select-for-withdrawal' | 'deposit' | 'withdrawal', required: The flow of the payment widget session.
    - `url` string, uri, required: The URL of the widget session that should be opened.
    - `token` string, required: The token identifying the authenticated user.
    - `data` object: Additional data associated with the session.

## Other responses

- `400`: Bad Request.
- `401`: Unauthorized.
- `403`: Forbidden.
- `409`: Business logic error.
- `429`: Too Many Requests.

---

[API](https://skmtc.dev/uphold/apis/widget-api.md) - [All operations](https://skmtc.dev/uphold/apis/widget-api/llms.txt) - [OpenAPI document](https://skmtc.dev/uphold/apis/widget-api/revisions/107ea0536686?raw)