Skip to main content
Your backend calls a single Connexease endpoint to mint a short-lived session token: the Session API. The SDK uses that token to run the rest of the onboarding for you, so this is the only endpoint you integrate with directly.

​
Endpoint

If you use a custom Gateway API base URL, replace only the origin:POST https://your-gateway-api.example.com/api/v1/wa/embedded-signup/sessionsKeep the /api/v1/wa/embedded-signup/sessions path unchanged. Your backend base URL should point to the same Gateway environment as the SDK’s apiBaseUrl.
​
string
required
Secret API key in Bearer sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx format.
​
string
required
Always application/json.
The recommended integration never calls this endpoint from the browser. Your backend calls it using the secret key (see Backend Integration), and the SDK calls your backend through fetchSessionToken.The SDK can call the Session API directly only when you explicitly pass secretKey to launch(). This is intended as a development fallback and should not be used in production because it exposes the secret key in the browser.

​
Response / Success (HTTP 200)

Your backend proxy must return the inner data object to fetchSessionToken:
You don’t need to rename or transform the fields inside data. The SDK automatically reads the compact gh, wv, pt, li, and bn fields.
Do not return the complete { isSuccess, data } response from your /api/session proxy. fetchSessionToken must receive the inner session object containing gh, wv, pt, li, and bn.

​
Errors

A failed request returns a non-2xx status with an error body, for example when the secret key is invalid:
In your proxy, forward non-2xx responses to the caller with their original status and body. Your fetchSessionToken implementation can read the error description and throw it so the SDK can show the error modal and deliver the error through onError. See Backend Integration.