Skip to content
EdgeKit

Exchange an upstream credential for an EdgeKit session

POST
/v1/id/session/exchange
curl --request POST \
  --url https://your-tenant-host/v1/id/session/exchange \
  --header 'Content-Type: application/json' \
  --header 'x-edgekit-site-id: site_example' \
  --data '{ "subject_token": "example", "subject_token_type": "example" }'

RFC 8693 in shape and in name. dual only: external_only mints no session, and a call in any other mode answers 404 rather than 403 so the surface does not confirm the route exists elsewhere. A browser sends the credential on its cookie; a native client sends subject_token in the body, because there is no cookie jar for get-session to read. Each call mints a new session; a 503 carries Retry-After and is safe to retry.

Parameters

Section titled “Parameters”

Header Parameters

Section titled “Header Parameters”
x-edgekit-site-id
required

The site this request is for, within this tenant. Every official EdgeKit SDK sets it from the client you configured; set it yourself only when calling this API directly.

string
>= 1 characters <= 128 characters

Example 

site_example

The site this request is for, within this tenant. Every official EdgeKit SDK sets it from the client you configured; set it yourself only when calling this API directly.

Request Body

Section titled “Request Body”
Media typeapplication/json
object
subject_token
string
>= 1 characters <= 8192 characters
subject_token_type
string
>= 1 characters <= 200 characters

Example generated

{
  "subject_token": "example",
  "subject_token_type": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

The user is signed in on this device.

Media typeapplication/json
object
user
required
object
id
required
string format: uuid
email
required
string
emailVerified
required
boolean
name
required
string | null
firstName
required
string | null
lastName
required
string | null
image
required
string | null
session
required
object
id
required
string format: uuid
kind
required
string
Allowed values: edgekit
expiresAt
required
string format: date-time

Example 

{
  "user": {
    "id": "01926f3a-8b4c-7d2e-9f10-2a3b4c5d6e7f",
    "email": "user@example.com",
    "emailVerified": true,
    "name": "Ada Lovelace",
    "firstName": "Ada",
    "lastName": "Lovelace",
    "image": null
  },
  "session": {
    "id": "01926f3a-8b4d-7a11-8c22-3d4e5f6a7b8c",
    "kind": "edgekit",
    "expiresAt": "2026-08-30T09:00:00.000Z"
  }
}

400

Section titled “400”

Invalid request.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

401

Section titled “401”

Missing or invalid credential.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

403

Section titled “403”

Not allowed.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

404

Section titled “404”

Resource not found.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

422

Section titled “422”

Request validation failed.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

500

Section titled “500”

Unexpected error.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

503

Section titled “503”

With Retry-After, briefly unavailable; without it, not configured.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
details

Example 

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}