exchangeSessionToken

Requires at least one of the permissions customers:customer:read, payments:invoice:read, payments:payment:read, sales:credit_note:read, sales:quote:read, sales:sales_order:read or visits:visit:read.

Exchange a session token from your admin extension for a 120-second rep-scoped token. With it your app reads ARC as that person: only the rights both your app and the person hold, and only their customers. Call it with your installation's own token. Never refreshed.

Errors: a failed call returns a GraphQL errors entry, not a field on the result, and data may be null or partial. Read the entry's extensions.code and message; every shape and code is in the Error reference.

Example:

GraphQL

mutation ExchangeSessionToken($sessionToken: String!) {
  exchangeSessionToken(sessionToken: $sessionToken) {
    expiresAt
    token
  }
}

cURL

curl -X POST "https://<api-host>/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  --data @- <<'EOF'
{
  "query": "mutation ExchangeSessionToken($sessionToken: String!) {\n  exchangeSessionToken(sessionToken: $sessionToken) {\n    expiresAt\n    token\n  }\n}",
  "variables": {
    "sessionToken": "string"
  }
}
EOF

Variables:

{
  "sessionToken": "string"
}

Response:

{
  "data": {
    "exchangeSessionToken": {
      "expiresAt": "2025-01-15T00:00:00Z",
      "token": "string"
    }
  }
}

exchangeSessionToken(
  sessionToken: String!
): AppBoundToken!

Arguments

exchangeSessionToken.sessionToken ● String! non-null scalar

The session token ARC gave your extension (App Bridge getSessionToken).

Type

AppBoundToken object

A rep-scoped app token: the app acts for one person, with only the rights both the app and that person hold, and sees only that person's customers.