Session

{
  "success": true,
  "data": {
    "external_id": "user_8412",
    "client_id": "csid_4f8a2c1e9b",
    "session": "pvs_Q2x1c3RlcnMgb2YgdG9rZW5zIGdvIGhlcmU...",
    "expires_at": "2026-10-26T08:19:11Z",
    "expires_in": 900
  },
  "meta": {
    "request_id": "req_5162c7cf7f87",
    "cached": false,
    "cache_age_seconds": 0,
    "version": "v1",
    "timestamp": "2026-10-26T08:04:11Z"
  }
}

{
  "success": true,
  "data": {
    "external_id": "user_8412",
    "client_id": "csid_4f8a2c1e9b",
    "session": "pvs_Q2x1c3RlcnMgb2YgdG9rZW5zIGdvIGhlcmU...",
    "expires_at": "2026-10-26T08:19:11Z",
    "expires_in": 900
  },
  "meta": {
    "request_id": "req_5162c7cf7f87",
    "cached": false,
    "cache_age_seconds": 0,
    "version": "v1",
    "timestamp": "2026-10-26T08:04:11Z"
  }
}

Creates a short-lived session for one of your platform users. It lets the embeddable wallet verification UI act for exactly this user without your API key ever reaching the browser. Create the session on your backend, pass session and client_id to your page, and create a new one when it expires. A session is valid for 15 minutes and only for your instance.

Body

string

required

Your id of the user. Alternatively pass csid_id.

Usage Example

curl -X POST "https://api-id.cabalspy.xyz/v1/platform-users/session" \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"external_id": "user_8412"}'

import requests

r = requests.post("https://api-id.cabalspy.xyz/v1/platform-users/session",
                  json={"external_id": "user_8412"},
                  headers={"Authorization": "Bearer YOUR_KEY"})
s = r.json()["data"]
print(s["session"], s["expires_at"])

const res = await fetch("https://api-id.cabalspy.xyz/v1/platform-users/session", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ external_id: "user_8412" }),
});
const { data } = await res.json();
// hand data.session and data.client_id to the page

Response

string

Your id of the user.

string

Your Instance ID (csid_...), public.

string

The session token, starts with pvs_. Treat it like a short-lived password for this user.

string

When the session expires.

integer

Lifetime in seconds, 900.

{
  "success": true,
  "data": {
    "external_id": "user_8412",
    "client_id": "csid_4f8a2c1e9b",
    "session": "pvs_Q2x1c3RlcnMgb2YgdG9rZW5zIGdvIGhlcmU...",
    "expires_at": "2026-10-26T08:19:11Z",
    "expires_in": 900
  },
  "meta": {
    "request_id": "req_5162c7cf7f87",
    "cached": false,
    "cache_age_seconds": 0,
    "version": "v1",
    "timestamp": "2026-10-26T08:04:11Z"
  }
}

Errors

Status	Code	Meaning
400	missing_parameter	external_id missing.
401	missing_api_key	API key missing.
403	invalid_api_key	API key invalid or not enabled for CabalSpy ID.
404	platform_user_not_found	No user with this id in your instance.
409	account_claimed	The person claimed the account and manages it themselves.
429	rate_limit_exceeded	Rate limit exceeded.

See Errors for the full list.

Introduction

Login

Data API

Users

Trading

Theses

Streams

White-Label

Competitions

Reference

Body

Usage Example

Response

Errors

​Body

​Usage Example

​Response

​Errors

Body

Usage Example

Response

Errors