# games.cavu.bindSession

> Published by [chris.pardy.family](https://lexicon.garden/identity/did:plc:dp7v5b5kejmmzzpwmqyf5wj6)

✓ This is the authoritative definition for this NSID.

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:dp7v5b5kejmmzzpwmqyf5wj6/games.cavu.bindSession)
- [Documentation](https://lexicon.garden/lexicon/did:plc:dp7v5b5kejmmzzpwmqyf5wj6/games.cavu.bindSession/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:dp7v5b5kejmmzzpwmqyf5wj6/games.cavu.bindSession/examples)

## Definitions

### `games.cavu.bindSession`

**Type**: `procedure`

Served by the game host named in a grant's hostService. The game server presents the grant and its attestation with a DPoP proof (DPoP header, ES256). The host verifies the attestation against the launch service's key, checks the grant is unexpired and names this host, checks `jkt` matches the proof key, consumes the nonce (which it minted for `player`), and binds a session to that key. Later calls (getCapabilities, com.atproto.repo.putRecord, ...) carry `Authorization: DPoP <session>` plus a fresh proof.

#### Input

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `attestation` | `ref` → `games.cavu.defs#attestation` | Yes |  |
| `grant` | `ref` → `games.cavu.defs#grant` | Yes |  |

#### Output

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `capabilities` | `array` | Yes |  |
| `expiresAt` | `string` (datetime) | Yes | Session lifetime, independent of (and longer than) the grant's. |
| `handle` | `string` (handle) | No |  |
| `player` | `string` (did) | Yes |  |
| `presence` | `boolean` | No | The player chose (at this host) to show what they're playing: the session may keep their games.atmosphere.status record (rkey 'self') naming this game's games.atmosphere.define record, and its capabilities include that write. Checked against the player's current choice on every write. |
| `session` | `string` | Yes | Opaque session token; only usable with the bound DPoP key. |

#### Errors

- **AuthRequired**: Missing or invalid DPoP proof.
- **InvalidGrant**: Bad attestation, wrong host, or unknown launch service key.
- **GrantExpired**
- **NonceUsed**
- **KeyMismatch**: The DPoP key's thumbprint is not the grant's jkt.
- **PlayerSignedOut**: The host no longer holds a session for the grant's player.

## Raw Schema

```json
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Served by the game host named in a grant's hostService. The game server presents the grant and its attestation with a DPoP proof (DPoP header, ES256). The host verifies the attestation against the launch service's key, checks the grant is unexpired and names this host, checks `jkt` matches the proof key, consumes the nonce (which it minted for `player`), and binds a session to that key. Later calls (getCapabilities, com.atproto.repo.putRecord, ...) carry `Authorization: DPoP <session>` plus a fresh proof.",
      "errors": [
        {
          "description": "Missing or invalid DPoP proof.",
          "name": "AuthRequired"
        },
        {
          "description": "Bad attestation, wrong host, or unknown launch service key.",
          "name": "InvalidGrant"
        },
        {
          "name": "GrantExpired"
        },
        {
          "name": "NonceUsed"
        },
        {
          "description": "The DPoP key's thumbprint is not the grant's jkt.",
          "name": "KeyMismatch"
        },
        {
          "description": "The host no longer holds a session for the grant's player.",
          "name": "PlayerSignedOut"
        }
      ],
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "attestation": {
              "ref": "games.cavu.defs#attestation",
              "type": "ref"
            },
            "grant": {
              "ref": "games.cavu.defs#grant",
              "type": "ref"
            }
          },
          "required": [
            "grant",
            "attestation"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "capabilities": {
              "items": {
                "ref": "games.cavu.defs#capability",
                "type": "ref"
              },
              "type": "array"
            },
            "expiresAt": {
              "description": "Session lifetime, independent of (and longer than) the grant's.",
              "format": "datetime",
              "type": "string"
            },
            "handle": {
              "format": "handle",
              "type": "string"
            },
            "player": {
              "format": "did",
              "type": "string"
            },
            "presence": {
              "description": "The player chose (at this host) to show what they're playing: the session may keep their games.atmosphere.status record (rkey 'self') naming this game's games.atmosphere.define record, and its capabilities include that write. Checked against the player's current choice on every write.",
              "type": "boolean"
            },
            "session": {
              "description": "Opaque session token; only usable with the bound DPoP key.",
              "maxLength": 256,
              "type": "string"
            }
          },
          "required": [
            "session",
            "player",
            "expiresAt",
            "capabilities"
          ],
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "games.cavu.bindSession",
  "lexicon": 1
}
```