---
title: "Create Session Client Token Endpoint"
method: POST
path: "/api/v1/sessions/{session_id}/client-token"
tags: ["sessions"]
---

# Create Session Client Token Endpoint

`POST /api/v1/sessions/{session_id}/client-token`

## Request

- Base URL: `https://api.withverifa.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.withverifa.com/api/v1/sessions/{session_id}/client-token`
- Auth: none declared

Issue a short-lived JWT the frontend uses to mount the embed widget.

Pattern matches Persona's `inquiry session token`, Stripe's `client_secret`,
and Plaid's `link_token`: the customer's backend creates the session,
immediately requests a client token, and passes ONLY the token to the
browser. The token expires in 30 minutes — much shorter than the session
capture URL (24h) — so a leak from logs / browser history / screenshots
becomes useless quickly.

Requires `sessions:write`. Publishable keys, which are scope-locked to
`sessions:create`, cannot call this endpoint — they're for the quickstart
`captureUrl`-less flow that creates and opens the session in one step from
the browser.

Returns: `{ "client_token": "ey...", "expires_at": "...", "session_id": "..." }`.

## Path parameters

- `session_id` string, required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/withverifa/apis/verifa.md) · [All operations](https://skmtc.dev/withverifa/apis/verifa/llms.txt) · [OpenAPI document](https://skmtc.dev/withverifa/apis/verifa/revisions/7288c82c9e33?raw)