> ## Documentation Index > Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt > Use this file to discover all available pages before exploring further. # Create Session > Creates a short-lived compute session from an API key or a trusted workload identity token. ## OpenAPI ````yaml /api-reference/customer-api.v1.openapi.json post /v1/admin/sessions openapi: 3.1.0 info: title: Mount Thor Customer API version: v1 servers: - description: Mount Thor customer API edge url: https://api.mountthor.com security: [] paths: /v1/admin/sessions: post: tags: - sessions summary: Create Session description: >- Creates a short-lived compute session from an API key or a trusted workload identity token. operationId: mint_customer_compute_session requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateCustomerSessionRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/MintCustomerComputeSessionResponse' description: Session minted '202': content: application/json: schema: $ref: '#/components/schemas/MintCustomerReviewSessionResponse' description: Review-only portal session minted '400': description: Request body failed validation '401': description: Missing or invalid API key '403': description: API key revoked, expired, or out of scope '429': content: text/plain: schema: type: string description: Rate limit exceeded headers: Retry-After: description: Seconds before retry. schema: minimum: 1 type: integer security: - api_key_bearer: - sessions:write - {} components: schemas: CreateCustomerSessionRequest: description: API-key or workload-identity session request. oneOf: - $ref: '#/components/schemas/MintCustomerComputeSessionRequest' - $ref: '#/components/schemas/WorkloadTokenExchangeRequest' MintCustomerComputeSessionResponse: additionalProperties: false description: >- Response body for `POST /v1/admin/sessions`. `session_token` is shown once; Mount Thor stores only its SHA-256 digest. properties: audience: description: API audience the session token is valid for. example: api.mountthor.com type: string customer_id: description: Customer account id the session is bound to. format: uuid type: string customer_user_id: description: Customer principal id the session is bound to. format: uuid type: string expires_at: description: RFC 3339 timestamp at which the session token expires. example: '2026-05-06T18:30:00Z' type: string issued_at: description: RFC 3339 timestamp at which the session token was issued. example: '2026-05-06T18:15:00Z' type: string namespace_name: description: Tenant namespace inside the customer's dedicated control plane. type: string refresh_token: type: - string - 'null' refresh_token_expires_at: description: RFC 3339 timestamp at which the refresh token expires (when set). type: - string - 'null' refresh_token_ttl_seconds: description: Refresh token TTL in seconds (when `refresh_token` is set). format: int32 type: - integer - 'null' scopes: description: Scopes granted to the session. example: - compute:read - compute:write items: type: string type: array session_id: description: Stable Mount Thor identifier for the minted session. format: uuid type: string session_token: description: >- Short-lived bearer token. Format: `mt_session_*`. Returned exactly once. example: mt_session_01JZ8M7EXAMPLE type: string session_ttl_seconds: description: Granted session TTL in seconds. format: int32 type: integer tenant_id: description: Tenant id the session is bound to. format: uuid type: string token_type: description: Always `"Bearer"`. example: Bearer type: string required: - session_id - audience - token_type - session_token - session_ttl_seconds - issued_at - expires_at - customer_id - tenant_id - customer_user_id - namespace_name - scopes type: object MintCustomerReviewSessionResponse: additionalProperties: false description: |- Tenantless browser credential returned only for a self-service account whose compute access is still under review. The established 201 session response above remains tenant-bound and byte-for-byte schema compatible; this additive shape is emitted with HTTP 202. properties: audience: example: api.mountthor.com type: string customer_id: format: uuid type: string customer_user_id: format: uuid type: string expires_at: example: '2026-05-06T18:30:00Z' type: string issued_at: example: '2026-05-06T18:15:00Z' type: string portal_access_state: description: >- Always `review`; the portal exposes only the compute-access review UI. type: string refresh_token: type: - string - 'null' refresh_token_expires_at: type: - string - 'null' refresh_token_ttl_seconds: format: int32 type: - integer - 'null' scopes: example: - access:read - sessions:write items: type: string type: array session_id: format: uuid type: string session_token: example: mt_session_01JZ8M7EXAMPLE type: string session_ttl_seconds: format: int32 type: integer token_type: example: Bearer type: string required: - session_id - audience - token_type - session_token - session_ttl_seconds - issued_at - expires_at - customer_id - customer_user_id - portal_access_state - scopes type: object MintCustomerComputeSessionRequest: additionalProperties: false description: >- Request body for `POST /v1/admin/sessions`. Mints a short-lived Mount Thor session token from a long-lived API key. The caller must present a valid `mthr_live_*` API key in the `Authorization` header. properties: session_ttl_seconds: description: >- Requested session TTL in seconds. Must be between 300 and 3600. Defaults to 900 (15 minutes) when omitted. example: 900 format: int32 maximum: 3600 minimum: 300 type: - integer - 'null' source_ip: description: Optional client-reported source IP, recorded for audit. maxLength: 128 type: - string - 'null' user_agent: description: Optional client-reported user agent, recorded for audit. maxLength: 512 type: - string - 'null' type: object WorkloadTokenExchangeRequest: additionalProperties: false description: >- Exchange a trusted workload OIDC token for a short-lived compute session. properties: grant_type: enum: - urn:ietf:params:oauth:grant-type:token-exchange type: string session_ttl_seconds: default: 900 format: int32 maximum: 3600 minimum: 300 type: integer source_ip: maxLength: 128 type: string subject_token: minLength: 1 type: string subject_token_type: enum: - urn:ietf:params:oauth:token-type:jwt type: string tenant_id: format: uuid type: string user_agent: maxLength: 512 type: string required: - grant_type - subject_token_type - subject_token - tenant_id type: object securitySchemes: api_key_bearer: bearerFormat: mthr_live_* description: Bearer scheme name used by typed customer admin operations. scheme: bearer type: http ````