---
title: "Authenticate and start a session (deprecated)"
method: POST
path: "/handshake"
tags: ["Authentication"]
---

# Authenticate and start a session (deprecated)

`POST /handshake`

When you do not have an API key you can request a session token using handshake which can then be used as your authentication token.

## Query parameters

- `auth` string
- `user` string
- `timestamp` integer
- `version` string

## Request body

- HandshakeRequest
  - `user` string — Username (required for login/password authentication).
  - `timestamp` integer — UNIX time used in seed of password hash (required for login/password authentication).
  - `version` string — API version the client understands. REST callers should omit it -- the version in the URL path wins; if both are sent and disagree, the path version is used and this parameter is ignored.

## Response `200`

Session info or error

- HandshakeResponse
  - `auth` string, nullable, required
  - `streamtoken` string, nullable, required
  - `api` string, required
  - `session_expire` union, required
    - integer
    - string
  - `update` string, required
  - `add` string, required
  - `clean` string, required
  - `max_song` integer, required
  - `max_album` integer, required
  - `max_artist` integer, required
  - `max_video` integer, required
  - `max_podcast` integer, required
  - `max_podcast_episode` integer, required
  - `songs` integer, required
  - `albums` integer, required
  - `artists` integer, required
  - `genres` integer, required
  - `playlists` integer, required
  - `searches` integer, required
  - `playlists_searches` integer, required
  - `users` integer, required
  - `catalogs` integer, required
  - `videos` integer, required
  - `podcasts` integer, required
  - `podcast_episodes` integer, required
  - `shares` integer, required
  - `licenses` integer, required
  - `live_streams` integer, required
  - `labels` integer, required
  - `username` string, required

## Other responses

- `400` — HTTP 400 Bad Request (errors 4705, 4710).
- `401` — HTTP 401 Unauthorized (error 4701).
- `403` — HTTP 403 Forbidden (errors 4700, 4703, 4742).
- `500` — HTTP 500 Internal Server Error (error 4702).

---

[API](https://skmtc.net/ampache/apis/ampache-rest-api.md) · [All operations](https://skmtc.net/ampache/apis/ampache-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ampache/ampache-rest-api/revisions/535feee32afb/schema)