Create a Short-Lived SDK Token
Exchange your private API key for a short-lived client token to initialize the Therius JS SDK in the browser safely.
POST /sdk/session exchanges your merchant private API key for a short-lived JWT clientToken with a 30-minute TTL. Pass the clientToken to the browser to initialize new TheriusSDK({ clientToken }). Your private key never reaches the browser — it stays on your server where it belongs.
The request body is entirely optional — call it with no body for a bare clientToken. Set country (required as soon as you also set amount, currency, or orderCode) to bind the session and get back a sessionId. See the parameters and response panels above for the full field list.
clientToken embeds an HMAC-SHA256 hash of your public key. Your raw private key is never present in the token payload and never reaches the browser.clientToken on the client side.
Authorizations
Your secret API key: Bearer prv_production_xxx (production) or Bearer prv_sandbox_xxx (sandbox).
Body
ISO 3166-1 alpha-2 code of the shopper country. Optional for a bare clientToken; required if you also set amount, currency, or orderCode (those create a bound checkout session).
Locked amount in minor units. Omit to let the browser SDK manage the amount.
Locked ISO 4217 currency. Omit to let the browser SDK manage it.
Number of installments to offer. Defaults to 1.
Your order reference to attach to the resulting payment.
Your shopper identifier - enables saved-card retrieval and the save-card checkbox for this session.
Pre-assigned Therius payment code, if you allocate them yourself.
UUID of a Checkout Builder configuration to bind to this session.
Declares this session's checkout starts a stored-credential mandate (e.g. {"type": "recurring"} for a merchant-managed subscription you bill against yourself later). Requires customerId. When set, the Checkout Widget shows a fixed "card will be saved" disclosure instead of the optional save-card checkbox, and the server forces tokenization + this stored-credential tagging on the resulting charge regardless of what the browser sends. Omit for a plain checkout that just follows the Checkout Builder's save-card setting.
The payer's billing address, if you already know it. The Checkout Widget does not ask the shopper for fields you supply here, and a purchase that carries no address of its own is filled in from it. Boleto requires an address to register the voucher.
Shipping address, same shape as billingAddress. Filled into a purchase that carries none of its own. Requires country.
The payer's data, when you already know it. The Checkout Widget prefills (or, when the merchant chose 'Required, hidden if in session', skips) the matching fields and a purchase fills what it left blank from it. Defaults, not locks. Requires country.
Locks the order's line items for this session. A purchase made with the session token uses these and ignores any lineItems in the purchase call.
Locks the Level 2/3 card data for this session. A purchase made with the session token always uses it and ignores any commercialData in the purchase call, because that call can come from the browser. Requires country.
Response
SDK session token
Short-lived JWT for the browser SDK. Pass as Bearer to the SDK endpoints.
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Token lifetime in seconds.
1800
The merchant default Checkout Builder config, when no checkoutConfigId was supplied.
Checkout session ID - present when country created a session.
Echoed session country.
Echoed locked amount.
Echoed locked currency.
Echoed stored-credential intent, present only when the request set cardOnFile.
SRI hash of the latest SDK bundle served at GET /sdk/js, when available. Prefer the immutable release in sdk.
The current immutable SDK release. Render url and integrity into the page script tag (with crossorigin="anonymous") on every page render; the URL always serves exactly the bytes the hash describes. Absent when no release is available, in which case use GET /sdk/js without integrity.