---
title: "Create a Session"
method: POST
path: "/sessions"
tags: ["Component Sessions"]
---

# Create a Session

`POST /sessions`

This endpoint creates a short-lived session token that your embedded components can use to authenticate and fetch data. You must call this endpoint from your backend server to avoid exposing your API key.

## Headers

- `accept` string, required
- `content-type` string, required

## Request body

- union
  - object
    - `gateway` object, required — Credentials and options required to create a session for Gateway components.
      - `api_key` string, required — The api key to retrieve the session token. MUST start with `v4_secret_`. Maximum 255 characters.
      - `merchant_id` string, required — The specific merchant ID to scope the session to. Maximum 20 digits.
      - `environment` 'production' | 'sandbox' — Specifies the gateway environment.
  - object
    - `merchant-central` object, required — Credentials and options required to create a session for Merchant Central components.
      - `api_key` string, required — Merchant Central API key. Maximum 255 characters.
      - `tenant_id` string, required — Your Merchant Central subdomain, e.g., "XXX" for XXX.iriscrm.com. Maximum 200 characters.
      - `merchant_id` string, required — The specific merchant ID to scope the session to. Maximum 20 digits.

## Response `200`

Session created successfully.

- object
  - `session_token` string
  - `expires_at` string

## Other responses

- `401` — Unauthorized
- `422` — Unprocessable Entity

---

[API](https://skmtc.net/nmi/apis/embedded-components-api.md) · [All operations](https://skmtc.net/nmi/apis/embedded-components-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/nmi/embedded-components-api/revisions/45c2ecda3685/schema)