> For the complete documentation index, see [llms.txt](https://partner.doc.bunq.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://partner.doc.bunq.com/documentation/bunq-as-a-service/chapter-0-setting-up-api-context/start-a-session.md).

# Start A Session

Sessions provide **temporary authentication**, meaning that even if a session token is exposed, it will automatically expire after a set period. This balances security with usability—developers don’t need to constantly re-authenticate, but access remains limited to prevent long-term misuse. This session-based approach is common in **high-security environments**, ensuring that access is time-limited and reducing persistent threats.

Once you have a session we'll return you the user object. So you have all details of your user.

The response of the session API call is a object with a **session token**, this is the token we'll use in subsequent requests to authenticate requests. There is also a **userid** in this response. Which we will use in the next calls.

```http
POST /v1/session-server

{
	"secret": "{{api_key}}"
}
```

```json
{
    "Response": [
        {
            "Id": {
                "id": 25536694
            }
        },
        {
            "Token": {
                "id": 25536694,
                "created": "2025-03-05 16:12:11.918100",
                "updated": "2025-03-05 16:12:11.918100",
                "token": "ce717e3001d979ff5e22bac13508b46e7ad740971d1d75c5371614e546ca8b83"
            }
        },
        {
            "UserCompany": { "id": 1822179,
                            "rest of the user object":...  }
        }
    ]
}
```

**If your session expires you simply call the /session-server endpoint again. This gives you a new session token to use**