Skip to main content
A session token represents a signed-in user. You get one from POST /v1/auth/login and send it in the Authorization header:
API keys are used directly in the x-wede-api-key header. There is no endpoint that exchanges an API key for a session token, and you do not need one.

​
Lifetime

A session token is valid for 8 hours (expires_in: 28800). There is no refresh endpoint: when the token expires, sign in again with POST /v1/auth/login.

​
When a token stops working

wede rejects a token with 401 unauthorized when:
  • it has expired;
  • its signature is invalid or it was altered;
  • the user’s account has been suspended;
  • the user’s sessions have been revoked, which invalidates every token issued before the revocation.
When you receive 401 with a session token, send the user back to sign in.

​
What a token can do

A session token acts with the permissions of the user’s role (rbac_level in the login response). A request outside those permissions returns 403 forbidden:
A session token reads production data by default. On GET /v1/events, GET /v1/events/:event_id and GET /v1/sync/status it can pass environment=sandbox to read sandbox data. Data written with a session token is always production data.

​
Where to use it

The wede SDKs accept a session token, so apps never need an API key.