Session keys
Validate a session grant and return its canonical address + owner challenge
Pure scope-hygiene check mirroring `register_session` (24h TTL, game binding, upgrade snapshot shape) plus the canonical session PDA and the owner challenge (what the passkey signs). Authenticated; submission-time pid→vault binding is enforced by the relay path.
Pure scope-hygiene check mirroring register_session (24h TTL, game binding,
upgrade snapshot shape) plus the canonical session PDA and the owner
challenge (what the passkey signs). Authenticated; submission-time
pid→vault binding is enforced by the relay path.
Authorization
cookieAuth pid_access<token>
JWT access token set by /auth/google/callback or /auth/refresh
In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/session-keys/grants/validate" \ -H "Content-Type: application/json" \ -d '{ "vault": "string", "accountId": "string", "sessionPubkey": "string", "allowedProgram": "string", "expiresAt": 0, "recordedHasAuthority": true, "recordedSlot": "string", "deadline": 0, "nonce": "string" }'{ "sessionAddress": "string", "registerPayload": "string"}