Create a Short-Lived SDK Token
Exchange your private API key for a short-lived client token to initialize the Therius JS SDK in the browser safely.
POST /sdk/session exchanges your merchant private API key for a short-lived JWT clientToken with a 30-minute TTL. Pass the clientToken to the browser to initialize new TheriusSDK({ clientToken }). Your private key never reaches the browser — it stays on your server where it belongs.
The request body is entirely optional — call it with no body for a bare clientToken. Set country (required as soon as you also set amount, currency, or orderCode) to bind the session and get back a sessionId. See the parameters and response panels above for the full field list.
clientToken embeds an HMAC-SHA256 hash of your public key. Your raw private key is never present in the token payload and never reaches the browser.clientToken on the client side.
Authorizations
Your secret API key: Bearer prv_production_xxx (production) or Bearer prv_sandbox_xxx (sandbox).
Body
ISO 3166-1 alpha-2 code of the shopper country. Optional for a bare clientToken; required if you also set amount, currency, or orderCode (those create a bound checkout session).
Locked amount in minor units. Omit to let the browser SDK manage the amount.
Locked ISO 4217 currency. Omit to let the browser SDK manage it.
Number of installments to offer. Defaults to 1.
Your order reference to attach to the resulting payment.
Your shopper identifier - enables saved-card retrieval and the save-card checkbox for this session.
Pre-assigned Therius payment code, if you allocate them yourself.
UUID of a Checkout Builder configuration to bind to this session.
Declares this session's checkout starts a stored-credential mandate (e.g. {"type": "recurring"} for a merchant-managed subscription you bill against yourself later). Requires customerId. When set, the Checkout Widget shows a fixed "card will be saved" disclosure instead of the optional save-card checkbox, and the server forces tokenization + this stored-credential tagging on the resulting charge regardless of what the browser sends. Omit for a plain checkout that just follows the Checkout Builder's save-card setting.
Response
SDK session token
Short-lived JWT for the browser SDK. Pass as Bearer to the SDK endpoints.
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Token lifetime in seconds.
1800
The merchant default Checkout Builder config, when no checkoutConfigId was supplied.
Checkout session ID - present when country created a session.
Echoed session country.
Echoed locked amount.
Echoed locked currency.
Echoed stored-credential intent, present only when the request set cardOnFile.
SRI hash for the SDK bundle, when available.