appSessionToken

Requires an authenticated session.

A 60-second token for an installed app's admin extension, naming you, this organization and the records the extension is open on. The app's own server verifies it with the app's client secret. Refused when the app is paused, uninstalled or switched off, does not extend the place, or a record is outside the customers you can see.

Errors: a failed call returns a GraphQL errors entry, not a field on the result, and data may be null or partial. Read the entry's extensions.code and message; every shape and code is in the Error reference.

Example:

GraphQL

query AppSessionToken($installationId: ID!, $target: String!) {
  appSessionToken(installationId: $installationId, target: $target) {
    expiresAt
    token
  }
}

cURL

curl -X POST "https://<api-host>/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  --data @- <<'EOF'
{
  "query": "query AppSessionToken($installationId: ID!, $target: String!) {\n  appSessionToken(installationId: $installationId, target: $target) {\n    expiresAt\n    token\n  }\n}",
  "variables": {
    "installationId": "id",
    "target": "string"
  }
}
EOF

Variables:

{
  "installationId": "id",
  "target": "string"
}

Response:

{
  "data": {
    "appSessionToken": {
      "expiresAt": "2025-01-15T00:00:00Z",
      "token": "string"
    }
  }
}

appSessionToken(
  context: AppSessionTokenContextInput
  installationId: ID!
  target: String!
): AppSessionToken!

Arguments

appSessionToken.context ● AppSessionTokenContextInput input

The records the extension is open on. Omit for the app's own page (admin.app.home).

appSessionToken.installationId ● ID! non-null scalar

The app installation.

appSessionToken.target ● String! non-null scalar

The place the extension is open in, e.g. admin.order.details.block.

Type

AppSessionToken object

A short-lived token an app extension sends to its own server to prove who is looking at what. It is not an ARC credential.