# app.tempomusic.gateway.createSession

> Published by [lexicons.tempomusic.fan](https://lexicon.garden/identity/did:plc:pxsuqmultto34oks44m2lgxm)

✓ This is the authoritative definition for this NSID.

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:pxsuqmultto34oks44m2lgxm/app.tempomusic.gateway.createSession)
- [Documentation](https://lexicon.garden/lexicon/did:plc:pxsuqmultto34oks44m2lgxm/app.tempomusic.gateway.createSession/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:pxsuqmultto34oks44m2lgxm/app.tempomusic.gateway.createSession/examples)

## Definitions

### `app.tempomusic.gateway.createSession`

**Type**: `procedure`

Exchange a PDS-minted service auth token for a gateway session. The service auth JWT travels in the Authorization header (aud = the gateway DID, lxm = this NSID) and is single-use. Browser callers (Origin header present) receive the session as an HttpOnly cookie and no sessionToken is returned.

#### Input

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `platform` | `string` | Yes | Client platform requesting the session. Web always receives cookie mode; other platforms receive token mode unless the request carries an Origin header. |

#### Output

**Encoding**: `application/json`

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `sessionToken` | `string` | No | Opaque session token (token mode only). Absent in cookie mode. |

## Raw Schema

```json
{
  "id": "app.tempomusic.gateway.createSession",
  "defs": {
    "main": {
      "type": "procedure",
      "input": {
        "schema": {
          "type": "object",
          "required": [
            "platform"
          ],
          "properties": {
            "platform": {
              "type": "string",
              "maxLength": 100,
              "description": "Client platform requesting the session. Web always receives cookie mode; other platforms receive token mode unless the request carries an Origin header.",
              "knownValues": [
                "android",
                "ios",
                "desktop",
                "web"
              ]
            }
          }
        },
        "encoding": "application/json"
      },
      "output": {
        "schema": {
          "type": "object",
          "properties": {
            "sessionToken": {
              "type": "string",
              "maxLength": 8192,
              "description": "Opaque session token (token mode only). Absent in cookie mode."
            }
          }
        },
        "encoding": "application/json"
      },
      "description": "Exchange a PDS-minted service auth token for a gateway session. The service auth JWT travels in the Authorization header (aud = the gateway DID, lxm = this NSID) and is single-use. Browser callers (Origin header present) receive the session as an HttpOnly cookie and no sessionToken is returned."
    }
  },
  "$type": "com.atproto.lexicon.schema",
  "lexicon": 1
}
```