Session tokens

A session token is a short-lived credential that lets an external caller reach a UDF on a team-only canvas. Your backend mints one and passes it to the browser as the fused_session_token query parameter on the UDF URL.

For the full embed pattern, see Securing Shared Tokens.

Mint a session token

POST /session-token/by-access-token/{canvas_token}

Scope: user or environment

{canvas_token} is the canvas token (fc_…) of the canvas you are granting access to. URL-encode it if it contains slashes — name-based tokens take the form fc_<team>/<canvas-name>.

Body

Field	Type	Required	Description
ttl	integer	No	Lifetime in seconds. Defaults to 3600; maximum 86400 (24 hours).

curl -X POST \
  -H "Authorization: Fused-Service-Token $FUSED_SERVICE_ACCOUNT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ttl": 3600}' \
  "https://www.fused.io/server/v1/session-token/by-access-token/fc_abcdef1234567890"

Response

Field	Type	Description
token	string	The canvas token the session token is bound to
session_token	string	The session token to pass as fused_session_token
expires_at	string	Expiry timestamp

Returns 404 Not Found if the canvas token does not exist — for example after the token was rotated. See Token lifecycle.

Revoke session tokens

DELETE /session-token/by-access-token/{canvas_token}

Scope: user or environment

Revokes all session tokens issued for that canvas token — not just one. Returns 204 No Content.

warning

Any embed or client still using a revoked session token stops working immediately. Mint replacements before revoking.

See also

• Securing Shared Tokens — public vs team access and the session-token embed flow
• Tokens & endpoints — canvas tokens and UDF URLs
• Overview — Authentication — the credentials that authenticate you to the API