---
title: "Mint Session"
method: POST
path: "/api/v1/auth/session"
tags: ["auth"]
---

# Mint Session

`POST /api/v1/auth/session`

Mint an HttpOnly session cookie from the caller's Firebase JWT.

The client calls this whenever Firebase auth state changes. The cookie
replaces the `?token=<jwt>` query param on tile URLs (MAIA-1715) — Mapbox
caches URLs but always picks up cookies fresh from the jar, so the
"tile-URL goes stale during long idle" bug class is eliminated.

Exempt from the terms gate because the cookie is tiles' only auth channel
(Mapbox cannot send custom headers) and the mint is driven by Firebase
auth-state changes, which do not re-fire on acceptance. A user who accepted
while the mint was blocked would otherwise have a broken map until their
next sign-in. Every endpoint the cookie unlocks is itself gated.

## Response `200`

Successful Response

- object

---

[API](https://skmtc.net/maia-analytics/apis/maia-api.md) · [All operations](https://skmtc.net/maia-analytics/apis/maia-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/maia-analytics/maia-api/revisions/ac8a0a8837e3/schema)