curl --silent --show-error --fail-with-body --request POST \
--url 'https://api.example.com/api/widget/session' \
--header 'Origin: REPLACE_WITH_ORIGIN'
{
"token": "YOUR_API_KEY",
"expiresAt": "2026-08-31T14:22:05Z",
"refreshAfterMs": 48000
}
Issue a short-lived token for the deployment-bound storefront
Opt-in with WIDGET_SESSION_ENABLED=true and WIDGET_LIVE_CHAT_ENABLED=true. Requires an exact Origin from WIDGET_SESSION_ALLOWED_ORIGINS…
POST
/
api
/
widget
/
session
curl --silent --show-error --fail-with-body --request POST \
--url 'https://api.example.com/api/widget/session' \
--header 'Origin: REPLACE_WITH_ORIGIN'
{
"token": "YOUR_API_KEY",
"expiresAt": "2026-08-31T14:22:05Z",
"refreshAfterMs": 48000
}
Opt-in with WIDGET_SESSION_ENABLED=true and WIDGET_LIVE_CHAT_ENABLED=true.
Requires an exact Origin from WIDGET_SESSION_ALLOWED_ORIGINS. Organization,
agent and optional site claims come from server configuration; request fields
cannot choose them. This identifies the public widget deployment, not the
shopper. Thread capability tokens still protect individual conversations.
The embed loader can renew this token using data-rw-session-endpoint.
Headers
Request body
No request body.Response
object
Status codes
| Code | Meaning |
|---|---|
200 | Non-cacheable signed widget token and renewal interval |
403 | Missing or unapproved Origin |
429 | Session issuance rate limit exceeded |
503 | Session issuance is disabled or its bindings are incomplete |
Using this contract
Read the source OpenAPI document for declared schemas and alternatives. This page also includes documented corrections from the spec overlays. Example IDs and values are illustrative; replace them with records from your workspace.curl --silent --show-error --fail-with-body --request POST \
--url 'https://api.example.com/api/widget/session' \
--header 'Origin: REPLACE_WITH_ORIGIN'
{
"token": "YOUR_API_KEY",
"expiresAt": "2026-08-31T14:22:05Z",
"refreshAfterMs": 48000
}
Last modified on November 13, 2026