Skip to main content
POST
/
users
/
{userId}
/
sessions
Mint a contact session token
curl --request POST \
  --url https://apix.spotzee.com/api/client/users/{userId}/sessions \
  --header 'Authorization: Bearer <token>'
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_at": "2026-04-29T18:30:00.000Z"
}

Documentation Index

Fetch the complete documentation index at: https://docs.spotzee.com/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
Authorization
string
header
required

Project-scoped secret API key (sk_…). Pass in the Authorization: Bearer <key> header. Grants access to the project the key was issued for.

Path Parameters

​
userId
string
required

Numeric ID (admin scope) or contact external_id (project scope) — the route resolves both.

Example:

"cust-9f4b21"

Response

A new contact session token.

A short-lived contact session token. Tokens are bound to one project and one contact, expire after 15 minutes, and are not refreshable.

​
token
string
required

Short-lived signed token that scopes subsequent calls to this contact. Pass in the X-Spotzee-Contact-Token header alongside a publishable key (pk_…) to call the preference-centre endpoints. Treat as bearer credentials — never log or persist.

Example:

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

​
expires_at
string | null
required

Token expiry. ISO 8601. Tokens are not refreshable — issue a new one when expired.

Example:

"2026-04-29T18:30:00.000Z"