Set Session Cookies

Using a JWT token and a checksum, this endpoint sets session cookies in the user’s browser.

This is typically used in iFrames where a client’s backend generates a JWT Token using its API key, and the backend then asks the end user’s browser to render an iFrame with the JWT Token embedded. The iFrame then calls this endpoint to set the cookies in the browser.

The checksum is computed using HMAC with the tokens as input to ensure the tokens have not been tampered with. If the checksum does not match, an error is thrown indicating that the tokens have been tampered with.

See also the GET /v2/auth/session endpoint.

You can use this endpoint to set the cookies in the iFrame, then redirect the user to the desired page using the redirectUrl parameter.

PUT /v2/auth/session

Set Session Cookies

cURL

curl --request PUT \
  --url https://rest.forestreet.com/v2/auth/session \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "refreshToken": "<string>",
  "idToken": "<string>",
  "checksum": "<string>",
  "redirectUrl": "<string>"
}
'

400

{
  "success": false,
  "errorCode": "INVALID_INPUT",
  "message": "Bad Request - Invalid input"
}

Authorizations

apiKeyAuthbearerAuthsessionIdQuery

x-api-key · string · header · required

Pass a static API key for every request, provided by your customer support.

Body

application/json

refreshToken · string · required

Refresh token to set in cookies.

Pattern: ^[A-Za-z0-9-_]+(?:\.[A-Za-z0-9-_]+)+$

idToken · string · required

JWT ID token for the user.

Pattern: ^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+$

checksum · string · required

Mandatory checksum for the tokens.

redirectUrl · string<uri>

If provided, redirects to this URL after setting cookies. The URL must be within the Forestreet domain.

Response

204

Session validated, and cookies set successfully; no redirectUrl provided.