Sign-up and API keys are open. Paid top-ups open soon.What changed
thinQit Dex
NL
Docs menu

API reference, Console auth

Exchange a sign-in code for a session

View as Markdown

POST/v1/console/auth/sessionoperation id createSession

Sets the __Host-dex_session cookie and returns the CSRF token the console must send in x-dex-csrf on every state-changing console call.

Authentication. None. This route is public.

Request body

application/json, schema SessionRequest

emailstringrequired
  • format email
  • at most 254 characters
codestringrequired
  • pattern ^[0-9]{6}$

Responses

200Signed in.

Headers: x-request-id, set-cookie

objectstringrequired
  • always "session"
account_idAccountIdrequired
  • pattern ^acc_[0-9A-HJKMNP-TV-Z]{26}$
csrf_tokenstringrequired
expires_atstringrequired
  • format date-time
400The request could not be read. Codes: invalid_json (not JSON, not UTF-8, or a \u escape that is half of a surrogate pair, such as "\ud800" without its low half), duplicate_key (a JSON object repeats a key; param is the JSON pointer of the repeated member, such as /questions/q1/options/a), unsupported_media_type (not application/json) and invalid_header (a malformed idempotency-key or x-client-request-id; param names the header).

Headers: x-request-id, x-client-request-id

Error envelope. See Errors for every type and code.

401The sign-in code did not work. Codes: invalid_code (the code is wrong or expired, or no code was asked for this address) and code_attempts_exceeded (the code had 5 wrong tries and no longer works, the right code included; ask for a new code).

Headers: x-request-id

Error envelope. See Errors for every type and code.

422The request is well-formed JSON but breaks a validation rule. param names the field as a dotted path. Codes: unknown_field, missing_field, invalid_type (wrong JSON type), invalid_value (right type, value out of range: an empty or over-long string, a state, instructions, criteria string or option description of only whitespace, an empty questions or options object, an empty state object or array, a pattern or allowed-value mismatch such as a label or level with outer whitespace, a state nested deeper than 32 levels, a bad date or date range), field_not_allowed (options or levels on the wrong question type), invalid_question_id, too_many_questions, too_many_options, invalid_levels (including two levels equal after Unicode NFC normalisation and lower-casing), invalid_min_confidence, duplicate_label (two option labels equal after Unicode NFC normalisation and lower-casing, such as Billing and billing), state_path_not_found, state_not_json and, on the console, top_up_limit_exceeded.

Headers: x-request-id, x-client-request-id

Error envelope. See Errors for every type and code.

429A rate limit or quota is exhausted. Retry after the given number of seconds. For test_daily_quota that is the time until 00:00 UTC; clients should not retry it automatically.

Headers: x-request-id, x-client-request-id, retry-after, ratelimit-policy, ratelimit

Error envelope. See Errors for every type and code.

500An unexpected error. Any charge was refunded. Retry with the same idempotency key.

Headers: x-request-id, x-client-request-id

Error envelope. See Errors for every type and code.

503maintenance: the console's database, sign-in or payments are unavailable for a moment. Retry after retry-after. Nothing was changed.

Headers: x-request-id, retry-after

Error envelope. See Errors for every type and code.

Examples

Illustrative values. Examples show the shape of requests and responses; the numbers in them are not measured results.

Request: code

{
  "email": "dev@example.nl",
  "code": "482913"
}

Response: session

{
  "object": "session",
  "account_id": "acc_01M4ZPXYG0F5KZNWJ47TAN9ZT2",
  "csrf_token": "c8f1b7e04a2d4c6f9e3a51d27b60f8a4",
  "expires_at": "2026-11-19T12:00:00Z"
}