> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stateset.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue a short-lived token for the deployment-bound storefront

> Opt-in with WIDGET_SESSION_ENABLED=true and WIDGET_LIVE_CHAT_ENABLED=true. Requires an exact Origin from WIDGET_SESSION_ALLOWED_ORIGINS…

Opt-in with WIDGET\_SESSION\_ENABLED=true and WIDGET\_LIVE\_CHAT\_ENABLED=true.
Requires an exact Origin from WIDGET\_SESSION\_ALLOWED\_ORIGINS. Organization,
agent and optional site claims come from server configuration; request fields
cannot choose them. This identifies the public widget deployment, not the
shopper. Thread capability tokens still protect individual conversations.
The embed loader can renew this token using data-rw-session-endpoint.

### Headers

**Origin** `string (uri)` *required*

### Request body

No request body.

### Response

`object`

**token** `string` *required*

**expiresAt** `string (date-time)` *required*

**refreshAfterMs** `integer` *required*

Minimum: `48000`. Maximum: `720000`.

### Status codes

| Code | Meaning |
| - | - |
| `200` | Non-cacheable signed widget token and renewal interval |
| `403` | Missing or unapproved Origin |
| `429` | Session issuance rate limit exceeded |
| `503` | Session issuance is disabled or its bindings are incomplete |

### Using this contract

Read the [source OpenAPI document](https://docs.stateset.com/spec/chat-widget.json) for declared schemas and alternatives.
This page also includes documented corrections from the [spec overlays](https://github.com/stateset/docs/tree/main/spec/overlays).
Example IDs and values are illustrative; replace them with records from your workspace.

```bash cURL theme={null}
curl --silent --show-error --fail-with-body --request POST \
  --url 'https://api.example.com/api/widget/session' \
  --header 'Origin: REPLACE_WITH_ORIGIN'
```

```json 200 theme={null}
{
  "token": "YOUR_API_KEY",
  "expiresAt": "2026-08-31T14:22:05Z",
  "refreshAfterMs": 48000
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.