Create a user session
Mint a bearer token for one of your users.
Mint a bearer token for one of your users.
Call this endpoint only from your trusted backend using its API token. Return the minted bearer token to the user's app or browser; never expose the server API token to the client.
Parameters
Values in the path and query string.
appid path The application the token is for.
Example:your-app-id userid path The user the token represents becomes the token's subject . This sits in the URL path, so the caller MUST URL encode it — a userid containing reserved characters spaces, '/', '%', ' ', '?', '+', etc. will otherwise be misread or rejected. ASP.NET Core percent decodes the value during route binding, so the method receives the original userid; do not decode it again.
Example:u-8842 JSON body
Send as application/json.
displayName Optional seeds/updates the auto provisioned profile's display name claims profile.md name rules: <= 64 chars . Oversize is REJECTED 400 by IdentityService.MintUserSessionTokenAsync, unlike the Bearer path's lenient drop don't reject rule the mint caller is the customer's own backend, so bad input should be surfaced, not silently swallowed.
pictureUrl Optional seeds/updates the auto provisioned profile's avatar URL claims profile.md img rules: https only, <= 512 chars . Same fail closed rejection rule as DisplayName above.
role Optional "user" default , "moderator", or "admin". Fail closed: anything else is a 400, never silently demoted to "user" claims profile.md role decision .
expiresIn Optional, seconds. Absent = non expiring Stream model, claims profile.md §9.1 . Must be a positive integer <= 0 is a 400.
{
"displayName": "Dave M.",
"pictureUrl": "https://example.com/avatars/u-8842.jpg",
"role": "<role>",
"expiresIn": 1
}Status codes
Every JSON response uses the API result envelope.
200 OK ApiResult 400 Bad Request ApiResult 401 Unauthorized ApiResult 409 Conflict ApiResult 500 Internal Server Error ApiResult