Mint session token
Exchanges your organization API key for a short-lived access token scoped to one end user, safe to hand to a browser.
Call this from your backend only — it takes the user id, optionally the group id, and optionally the user’s tool credentials. An omitted group_id falls back to the user’s current group, then the organization’s Default group. Display names live on the update routes (PATCH /v1/users/{userId} / PATCH /v1/groups/{groupId}), not here.
Session tokens are scoped to the chat runtime. Endpoints that modify your organization — agents, workflows, prompt blocks, tool providers — require the API key from your backend.
Authorizations
Organization API key, generated in studio.sidenet.ai. Backend only — never in a browser.
Body
Your stable id for the end user. Becomes their identity on every call this token makes. An id that hasn't been seen before CREATES the user — name them via PATCH /v1/users/{userId}, or pre-create with POST /v1/users.
"user_4821"
The group this session belongs to — today the unit billing and spend caps attach to. An id that hasn't been seen before CREATES the group, with the default spend cap — name and cap it via PATCH /v1/groups/{groupId}, or pre-create with POST /v1/groups. Optional: when omitted, the session uses the user's current group (set by a previous mint, chat call, or PATCH /v1/users/{userId}), falling back to the organization's Default group. Send it explicitly if you bill per team — the fallback is silent.
"grp_84f20c19"
Per-provider credentials, keyed by tool provider id — { "PROVIDER_ID": { "credentials": { … }, "base_url"?: "…" } }. Stored on the user (encrypted at rest) and injected server-side on every call they make — sessions, workflow runs and schedules alike. Only the providers you send are replaced. Never returned, logged, or cached.
Response
Session created