Sessions
Exchange a session token for a runtime connect token
Called from the EMBED’S BROWSER with the session token (the token IS the auth — no API key). Admits the session under your per-tenant + the global concurrency caps and your daily session-minutes budget, then returns a short-lived runtime connect token plus the world to play. All cost controls are enforced here.
POST
Exchange a session token for a runtime connect token
Authorizations
The scoped runtime session JWT from POST /v1/sessions/token. The embed's browser presents it (Authorization: Bearer, or a token body field) to the runtime exchange routes. Not an API key.
Body
application/json
The session JWT (or send it as Authorization: Bearer).
Previous
Bind the runtime sessionId to the session (attribution)The embed posts the runtime sessionId (known only after connect) so the platform can attribute the live session to your app for usage + reactive kill. app_id is taken from the verified session token, never the client.
Next
Exchange a session token for a runtime connect token