Skip to main content
POST
POST /sdk/session intercambia tu clave de API privada de comercio por un clientToken JWT de corta duración con un TTL de 30 minutos. Pasa el clientToken al navegador para inicializar new TheriusSDK({ clientToken }). Tu clave privada nunca llega al navegador — se queda en tu servidor, donde pertenece.
Llama a este endpoint solo desde tu servidor. Nunca lo llames desde JavaScript del navegador ni expongas tu clave de API privada al lado del cliente.
El cuerpo de la solicitud es completamente opcional — llámalo sin cuerpo para obtener un clientToken simple. Establece country (requerido en cuanto también estableces amount, currency u orderCode) para vincular la sesión y recibir un sessionId. Ver los paneles de parámetros y respuesta de arriba para la lista completa de campos.
El clientToken incrusta un hash HMAC-SHA256 de tu clave pública. Tu clave privada sin procesar nunca está presente en la carga del token y nunca llega al navegador.
Ver Bootstrap de sesión en la pestaña JS SDK para saber cómo usar el clientToken del lado del cliente.

Autorizaciones

​
Authorization
string
header
requerido

Your secret API key: Bearer prv_production_xxx (production) or Bearer prv_sandbox_xxx (sandbox).

Cuerpo

application/json
​
country
string

ISO 3166-1 alpha-2 code of the shopper country. Optional for a bare clientToken; required if you also set amount, currency, or orderCode (those create a bound checkout session).

​
amount
integer

Locked amount in minor units. Omit to let the browser SDK manage the amount.

​
currency
string

Locked ISO 4217 currency. Omit to let the browser SDK manage it.

​
installments
integer

Number of installments to offer. Defaults to 1.

​
orderCode
string

Your order reference to attach to the resulting payment.

​
customerId
string

Your shopper identifier - enables saved-card retrieval and the save-card checkbox for this session.

​
paymentCode
string

Pre-assigned Therius payment code, if you allocate them yourself.

​
checkoutConfigId
string

UUID of a Checkout Builder configuration to bind to this session.

​
cardOnFile
object

Declares this session's checkout starts a stored-credential mandate (e.g. {"type": "recurring"} for a merchant-managed subscription you bill against yourself later). Requires customerId. When set, the Checkout Widget shows a fixed "card will be saved" disclosure instead of the optional save-card checkbox, and the server forces tokenization + this stored-credential tagging on the resulting charge regardless of what the browser sends. Omit for a plain checkout that just follows the Checkout Builder's save-card setting.

Respuesta

200 - application/json

SDK session token

​
clientToken
string

Short-lived JWT for the browser SDK. Pass as Bearer to the SDK endpoints.

Ejemplo:

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

​
expiresIn
integer

Token lifetime in seconds.

Ejemplo:

1800

​
defaultCheckoutConfigId
string

The merchant default Checkout Builder config, when no checkoutConfigId was supplied.

​
sessionId
string

Checkout session ID - present when country created a session.

​
country
string

Echoed session country.

​
amount
integer

Echoed locked amount.

​
currency
string

Echoed locked currency.

​
cardOnFile
object

Echoed stored-credential intent, present only when the request set cardOnFile.

​
sdkIntegrity
string

SRI hash for the SDK bundle, when available.