Exchange a Bearer token for a web session cookie
POST
/api/auth/session-from-token
Mints a NextAuth session cookie for the owner of the supplied Bearer token and
returns it in a Set-Cookie header. Used by the iOS app to log its WKWebView back
in when the 7-day session JWT expires, using the long-lived token in its keychain.
Bearer authentication only — a missing, malformed, or invalid Authorization
header returns 401. This endpoint never falls back to session cookie or proxy
header auth.
The cookie is HttpOnly, SameSite=Lax, Path=/, expires in 7 days, and is named
__Secure-authjs.session-token over HTTPS (authjs.session-token otherwise).
Authorizations
bearerAuth
API token created via POST /api/tokens or the db:create-token CLI command
Type
HTTP (bearer)
Responses
Session cookie issued
application/json
JSON
{
"data": {
"ok": true
}
}
POST
/api/auth/session-from-token