> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.getsinbad.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.getsinbad.com/_mcp/server. # Create a customer session POST https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions Content-Type: application/json Create a customer session. **Credential:** Partner secret **Before you call** - A server-side partner secret for the owning partner. Do not send an Origin header. Creates a 24-hour customer session. Call this from your server with your partner secret, and do not send an `Origin` header. `integrationId` and `partnerUserId` are required. Take `partnerUserId` from your own verified login. A customer's first request must also include `fullName`, a verified email address (`email` with `emailVerified: true`), `walletAddress` and `chainId`. Later requests can omit details that Sinbad already has. If you send changed contact details, they must be verified again. Creating another session never changes the customer's wallet or chain. A wallet, email address or optional phone number must be unique among your partner's active customers, across integrations. Wallet and email comparisons ignore case, and phone numbers use E.164 format. A duplicate returns `409 CONFLICT`. If your partner account setup is incomplete, registering a new customer or changing contact details can return `502 UPSTREAM_ERROR`: contact Sinbad and quote the `requestId`. Existing customers can still get sessions, and deleting a customer still works. Every successful request creates a new session. Sinbad limits session creation per partner and per customer. The defaults are 60 and 5 per minute, and Sinbad can configure different values at onboarding. Invalid credentials do not use quota, and only a session that is actually created does. A `429 RATE_LIMITED` response includes `Retry-After` and `error.details.retryAfter`, in seconds. Cache the token until shortly before it expires. > Confirm with Sinbad that this endpoint is enabled in your environment. **Errors** | Status | Code | What to do | | --- | --- | --- | | 400 | `VALIDATION_ERROR` | Correct the fields reported in details before retrying. | | 401 | `UNAUTHENTICATED` | Create a new customer session or use a valid server credential. | | 403 | `FORBIDDEN` | Check credential ownership, integration and the supplied Origin. | | 409 | `CONFLICT` | Read the current state again before you prepare or retry. | | 429 | `RATE_LIMITED` | Wait for Retry-After before retrying. | | 502 | `UPSTREAM_ERROR` | Retry with backoff and quote requestId if it persists. For transaction reports, retry the same hash without sending another transaction. | | 503 | `UPSTREAM_ERROR` | Retry with backoff; preserve the same idempotency key for a repeated mutation. | Reference: https://docs.getsinbad.com/api-reference/sessions/create-customer-session ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Request ### Body (application/json) This endpoint expects an auth__MintInput. - `integrationId` (string, required) - `partnerUserId` (string, required) — Case-sensitive; no leading/trailing whitespace or control characters. - `fullName` (string, optional) - `preferredName` (string, optional) - `email` (string, optional) — Requires emailVerified=true; normalized to lowercase. - `emailVerified` (boolean, optional) — Requires email in the same request. - `phone` (string, optional) — Requires phoneVerified=true. - `phoneVerified` (boolean, optional) — Requires phone in the same request. - `walletAddress` (string, optional) — Nonzero EVM address; mixed-case checksum validated. Requires chainId. Stored lowercase, no smart-account or signer assumption. - `chainId` (integer, optional) — Requires walletAddress and approved integration chain. - `country` (string, optional) - `dateOfBirth` (date, optional) — Valid past date; partner assertion, not KYC evidence. - `locale` (string, optional) - `partnerSessionId` (string, optional) — Optional correlation; only its SHA-256 digest is audited. No replay prevention or idempotency. ## Response ### 200 First or subsequent session; no refresh token - `sessionToken` (string, required) - `sessionId` (string, required) - `expiresIn` (enum, required) - Allowed values: `86400` - `expiresAt` (datetime, required) - `userId` (string, required) - `kycStatus` (string, required, nullable) — Always null in auth-only phase. Future KYC adapter owns status reads. - `isNewUser` (boolean, required) ## Errors ### 400 Bad Request Error The request is invalid. - `error` (V1SessionsPostResponsesContentApplicationJsonSchemaError, required) ### 401 Unauthorized Error Authentication is required. - `error` (V1SessionsPostResponsesContentApplicationJsonSchemaError, required) ### 403 Forbidden Error You do not have permission to perform this action. - `error` (V1SessionsPostResponsesContentApplicationJsonSchemaError, required) ### 409 Conflict Error The request conflicts with the current state of the resource. - `error` (V1SessionsPostResponsesContentApplicationJsonSchemaError, required) ### 429 Too Many Requests Error Too many requests. Please try again later. - `error` (V1SessionsPostResponsesContentApplicationJsonSchemaError, required) ### 502 Bad Gateway Error A required service is unavailable. - `error` (V1SessionsPostResponsesContentApplicationJsonSchemaError, required) ### 503 Service Unavailable Error Service temporarily unavailable. - `error` (V1SessionsPostResponsesContentApplicationJsonSchemaError, required) ## Types ### V1SessionsPostResponsesContentApplicationJsonSchemaError - `code` (string, required) - `numericId` (integer, required) - `message` (string, required) - `requestId` (string, optional) - `details` (map from string to any, optional) ## Examples ### Default **Request** ```json { "integrationId": "integration_demo", "partnerUserId": "customer_demo", "fullName": "Alex Example", "preferredName": "Alex", "email": "alex@example.com", "emailVerified": true, "walletAddress": "0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a", "chainId": 80002, "country": "GB", "dateOfBirth": "1995-04-12", "locale": "en" } ``` **Response** ```json { "sessionToken": "eyJhbGciOiJSUzI1NiJ9.example.signature", "sessionId": "session_demo", "expiresIn": 86400, "expiresAt": "2026-10-24T10:00:00.000Z", "userId": "user_demo", "kycStatus": null, "isNewUser": true } ``` **SDK Code** ```python Default import requests url = "https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions" payload = { "integrationId": "integration_demo", "partnerUserId": "customer_demo", "fullName": "Alex Example", "preferredName": "Alex", "email": "alex@example.com", "emailVerified": True, "walletAddress": "0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a", "chainId": 80002, "country": "GB", "dateOfBirth": "1995-04-12", "locale": "en" } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript Default const url = 'https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"integrationId":"integration_demo","partnerUserId":"customer_demo","fullName":"Alex Example","preferredName":"Alex","email":"alex@example.com","emailVerified":true,"walletAddress":"0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a","chainId":80002,"country":"GB","dateOfBirth":"1995-04-12","locale":"en"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Default package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions" payload := strings.NewReader("{\n \"integrationId\": \"integration_demo\",\n \"partnerUserId\": \"customer_demo\",\n \"fullName\": \"Alex Example\",\n \"preferredName\": \"Alex\",\n \"email\": \"alex@example.com\",\n \"emailVerified\": true,\n \"walletAddress\": \"0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a\",\n \"chainId\": 80002,\n \"country\": \"GB\",\n \"dateOfBirth\": \"1995-04-12\",\n \"locale\": \"en\"\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Default require 'uri' require 'net/http' url = URI("https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"integrationId\": \"integration_demo\",\n \"partnerUserId\": \"customer_demo\",\n \"fullName\": \"Alex Example\",\n \"preferredName\": \"Alex\",\n \"email\": \"alex@example.com\",\n \"emailVerified\": true,\n \"walletAddress\": \"0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a\",\n \"chainId\": 80002,\n \"country\": \"GB\",\n \"dateOfBirth\": \"1995-04-12\",\n \"locale\": \"en\"\n}" response = http.request(request) puts response.read_body ``` ```java Default import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"integrationId\": \"integration_demo\",\n \"partnerUserId\": \"customer_demo\",\n \"fullName\": \"Alex Example\",\n \"preferredName\": \"Alex\",\n \"email\": \"alex@example.com\",\n \"emailVerified\": true,\n \"walletAddress\": \"0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a\",\n \"chainId\": 80002,\n \"country\": \"GB\",\n \"dateOfBirth\": \"1995-04-12\",\n \"locale\": \"en\"\n}") .asString(); ``` ```php Default request('POST', 'https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions', [ 'body' => '{ "integrationId": "integration_demo", "partnerUserId": "customer_demo", "fullName": "Alex Example", "preferredName": "Alex", "email": "alex@example.com", "emailVerified": true, "walletAddress": "0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a", "chainId": 80002, "country": "GB", "dateOfBirth": "1995-04-12", "locale": "en" }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp Default using RestSharp; var client = new RestClient("https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions"); var request = new RestRequest(Method.POST); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"integrationId\": \"integration_demo\",\n \"partnerUserId\": \"customer_demo\",\n \"fullName\": \"Alex Example\",\n \"preferredName\": \"Alex\",\n \"email\": \"alex@example.com\",\n \"emailVerified\": true,\n \"walletAddress\": \"0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a\",\n \"chainId\": 80002,\n \"country\": \"GB\",\n \"dateOfBirth\": \"1995-04-12\",\n \"locale\": \"en\"\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift Default import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [ "integrationId": "integration_demo", "partnerUserId": "customer_demo", "fullName": "Alex Example", "preferredName": "Alex", "email": "alex@example.com", "emailVerified": true, "walletAddress": "0x19e7e376e7c213b7e7e7e46cc70a5dd086daff2a", "chainId": 80002, "country": "GB", "dateOfBirth": "1995-04-12", "locale": "en" ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ``` ### Returning customer **Request** ```json { "integrationId": "integration_demo", "partnerUserId": "customer_demo" } ``` **Response** ```json { "sessionToken": "eyJhbGciOiJSUzI1NiJ9.example.signature", "sessionId": "session_demo", "expiresIn": 86400, "expiresAt": "2026-10-24T10:00:00.000Z", "userId": "user_demo", "kycStatus": null, "isNewUser": false } ``` **SDK Code** ```python Returning customer import requests url = "https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions" payload = { "integrationId": "integration_demo", "partnerUserId": "customer_demo" } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript Returning customer const url = 'https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"integrationId":"integration_demo","partnerUserId":"customer_demo"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Returning customer package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions" payload := strings.NewReader("{\n \"integrationId\": \"integration_demo\",\n \"partnerUserId\": \"customer_demo\"\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Returning customer require 'uri' require 'net/http' url = URI("https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"integrationId\": \"integration_demo\",\n \"partnerUserId\": \"customer_demo\"\n}" response = http.request(request) puts response.read_body ``` ```java Returning customer import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"integrationId\": \"integration_demo\",\n \"partnerUserId\": \"customer_demo\"\n}") .asString(); ``` ```php Returning customer request('POST', 'https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions', [ 'body' => '{ "integrationId": "integration_demo", "partnerUserId": "customer_demo" }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp Returning customer using RestSharp; var client = new RestClient("https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions"); var request = new RestRequest(Method.POST); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"integrationId\": \"integration_demo\",\n \"partnerUserId\": \"customer_demo\"\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift Returning customer import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [ "integrationId": "integration_demo", "partnerUserId": "customer_demo" ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/sessions")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```