# Trade the bootstrap code for the session token

> Trade the bootstrap code for the session token: CustomDomain™ API reference in the cloud browser group. Covers parameters, request body and responses.

Source: https://docs.customdomain.ai/docs/api-reference/cloud-browser/redeemBrowserSession

## `POST https://api.customdomain.ai/v1/browser-sessions:redeem`

The popup page calls this once, with the code from its address fragment. The code lives two minutes and works once; a second redemption answers `410 browser_link_used`. The `Origin` header must be on the server's return origin allowlist (a browser sends it; a request with none is refused with `browser_customer_present_only`). The token it returns lives in the popup's memory only.

### Authentication

None.

### Request body (JSON)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | string | yes |  |

### Responses

| Status | Description |
| --- | --- |
| `200` | The session token and the first view. |
| `400` | Error envelope: {code, title, details}. |
| `403` | Error envelope: {code, title, details}. |
| `410` | `browser_link_used` (already redeemed) or `browser_expired` (the code ran out, or the session ended). |
| `503` | Error envelope: {code, title, details}. |

### `200` response body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `session_id` | string | yes |  |
| `token` | string | yes | The session token. A bearer: never log it or store it. |
| `view` | object | yes | One cloud browser session as the popup may see it. `live_view_url` and `live_view_origin` are present only in `awaiting_sign_in` and `manual_assist` (`interactive` true) and, read only, in `checking`, `plan_ready`, `applying` and `verifying`; never in a terminal state. The address is a bearer: anyone holding it can drive the browser. While the customer signs in it is the live view of the newest tab of the remote browser on the provider's hosts or a social sign in host of the provider (a sign in popup), and the first tab's again once that one closes. It is always that tab's own view, so the debugging socket its `wss` parameter names is that tab's too. |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.