Log inTalk to us
Developer tools

Get a session token for an installed app

post/v1/apps/session-tokens
Requires an API key

For the dashboard to hand to an app's UI (getAccessToken). A signed-in member of the project's team asks for a token for an active install. It lasts 5 minutes; its scopes are the install's consented scopes within what your team role in the project allows, and never an Ivora staff role: a staff member who is not in the team gets 403. The app's UI origins may call /v1 with it from the browser (CORS), and its backend verifies it with /v1/apps/jwks.json and exchanges it at /v1/oauth/token. API keys, connected apps and app tokens cannot ask for one. 409 consent_outdated when the app added a UI origin since the install was consented to.

Request body

  • install_idstringRequired
    The install (the app in this project) the token is for.
    Pattern ^ins_[0-9a-f]{32}$
  • scopesarray of string | null
    A subset of the scopes the install and your role allow; omit for all of them.

Returns · 200

  • tokenstringRequired
    A signed JWT for the app's UI. Verify it with the keys at /v1/apps/jwks.json; its audience is the app's id.
  • token_typestringRequired
  • expires_inintegerRequired
    Seconds: 300.
  • scopestringRequired
    Space-separated scopes: the install's, within your current team role in the project.
  • install_idstringRequired
  • app_idstringRequired
  • tenant_idintegerRequired
POST /v1/apps/session-tokens
curl --fail-with-body -X POST "https://api.ivoracharge.com/v1/apps/session-tokens" \
  -H "Authorization: Bearer $IVORA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "install_id": "ins_0123456789abcdef0123456789abcdef"
}'
Response · 200JSON
{
  "token": "string",
  "token_type": "string",
  "expires_in": 1,
  "scope": "string",
  "install_id": "install_0123456789abcdef",
  "app_id": "app_0123456789abcdef",
  "tenant_id": 1042
}
Requires an approved production API keyProduction access starts with a request, a short meeting with Ivora and a card on file, after which Ivora staff grant your account access. How to request access
Try itproduction · api.ivoracharge.com

Paste a production api key (iv_live_…). Create keys in Developer tools. The key stays in this page's memory, is sent only to https://api.ivoracharge.com and clears when you reload. Test keys are refused.

POST is a write: you confirm the method, path and project before it is sent, with a generated Idempotency-Key.