Partners

Mint a builder session for a browser

POST/v1/embed-sessions

Requires an API key with the workspaces:manage scope. About keys and scopes

Partner keys only, from your server, with Kirora-Workspace naming the tenant. Returns a token the embedded segment and email builders send as Authorization: Bearer es_… for 15 minutes; the SDK asks your server for a new one before it expires. The key must have allowedOrigins, and a session is refused with 403 EMBED_ORIGIN_NOT_ALLOWED from any other origin. A session reads what its components need, renders previews, counts audiences and uploads images; it never creates, edits, deletes, publishes or sends, since your server saves what the builders return. It sees masked attributes as a member does, and attribute values and event property samples only with includeAttributeValues. Revoking the key ends every session it minted.

Request body

componentsstring[]required

The builders the browser may load; each opens only the routes it needs.

at least 1 item

includeAttributeValuesbooleanoptional

Lets the session read attribute values and event property samples, for value suggestions. Off by default: they are the workspace's customer data.

default false

Returns

Returns 201 Created with a EmbedSession in data. Otherwise returns an error; Errors lists every code and which to retry.

tokenstringrequired

For Kirora's hosted builder, which sends it as Authorization: Bearer <token>; it works only inside a page whose origin the partner key allows.

expiresAtstringrequired

When the token stops working (15 minutes).

date-time

apiUrlstringrequired

The API's base URL, for KiroraProvider's apiUrl.

uri

builderUrlstringrequired

The hosted builders' base address; @kirora/react opens each builder under it.

uri

curl -X POST https://api.kirora.io/v1/embed-sessions \
  -H "Authorization: Bearer $KIRORA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "components": [
      "segment-builder"
    ]
  }'

const response = await fetch('https://api.kirora.io/v1/embed-sessions', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.KIRORA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "components": [
      "segment-builder"
    ]
  }),
});
const { data } = await response.json();

import os

import requests

response = requests.post(
    "https://api.kirora.io/v1/embed-sessions",
    headers={
        "Authorization": f"Bearer {os.environ['KIRORA_API_KEY']}",
    },
    json={
        "components": [
            "segment-builder",
        ],
    },
)
data = response.json()["data"]

package main

import (
	"bytes"
	"encoding/json"
	"net/http"
	"os"
)

func main() {
	body := []byte(`{
	  "components": [
	    "segment-builder"
	  ]
	}`)
	req, err := http.NewRequest("POST", "https://api.kirora.io/v1/embed-sessions", bytes.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("KIRORA_API_KEY"))
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	var out struct {
		Data json.RawMessage `json:"data"`
	}
	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
		panic(err)
	}
}

Response · 201

{
  "data": {
    "token": "token_example",
    "expiresAt": "2030-03-14T09:30:00Z",
    "apiUrl": "https://example.com",
    "builderUrl": "https://example.com"
  }
}

Example values are generated from the schema.