Skip to main content
POST
/
v1
/
session
/
login
/
finalize
Finalize login
curl --request POST \
  --url https://{appId}.session.prelude.dev/v1/session/login/finalize \
  --header 'Content-Type: application/json' \
  --data '
{
  "challenge_token": "<string>",
  "code_verifier": "<string>"
}
'
{
  "access_token": "<string>",
  "expires_at": 123
}

Headers

​
X-Refresh-Token
string

Optional refresh token from a previous session. When provided, the session associated with this token is revoked once the new session is established, so a re-login does not leave the old session dangling. Ignored when the token is missing or can no longer be resolved to an active session.

Body

application/json
​
challenge_token
string
required

The challenge token obtained from a login method.

Example:

"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9..."

​
code_verifier
string

PKCE code verifier matching the code_challenge originally sent on the login flow (OAuth, standalone OTP, or migration). Required when the challenge token carries a pkce_challenge claim; ignored otherwise.

Example:

"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

Response

OK

​
access_token
string
required
Example:

"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9..."

​
expires_at
integer<int64>
required

Unix timestamp of when the access token expires.

Example:

1717689600