API product catalogDeveloper Platform, Sandbox & Key Management

Mint a portal session token

Developer Platform, Sandbox & Key Management

POST

/session

Production onlyPortal sign-in requiredcreatePartnerSession

Exchanges a Firebase ID token (the partner's portal login) for a short-lived ms_oauth_ access token that can be sent as Authorization: Bearer <token> to any partner endpoint. This exists because partner API keys are stored only as SHA-256 hashes: the raw pk_live_ key is displayed once, at issue or rotation, and is unrecoverable afterwards. GET /me can therefore only return a mask. A signed-in portal session uses this endpoint to obtain a credential it can actually call with. The token carries the active organization member and mirrors the underlying key's scopes and type. Effective access is the intersection of member permissions, key scopes, organization security policy, and environment policy. It expires after 1 hour and can be revoked earlier. Server-to-server integrations should keep using their pk_live_ key directly, or the OAuth client-credentials flow (POST /partner/oauth/token) — not this endpoint.

Parameters

This endpoint has no path or query parameters.

Headers

AuthorizationstringRequired

Bearer Firebase ID token from your partner portal session.

Response fields

accessTokenstring

Send as Authorization: Bearer <accessToken>. Prefixed ms_oauth_.

tokenTypeBearer

expiresIninteger

Lifetime in seconds (3600).

keyTypefull | data

Mirrors the underlying key. data tokens are read-only market-data credentials.

memberobject

member.idstringRequired

member.uidstring

member.emailstringRequired

member.displayNamestring | null

member.roleIdsstring[]Required

member.permissionsstring[]Required

member.statusINVITED | ACTIVE | SUSPENDED | REMOVEDRequired

member.activeSessionCountinteger

permissionsstring[]

sessionIdstring

Response codes

200A short-lived partner access token.

401Missing or invalid Firebase ID token.

403No partner key provisioned for this account, or the key is suspended/revoked.

Request reference

Production only

This operation requires a partner portal session. Follow the authentication guide.

https://mystocks.africa/api/v1/partner/session

API Reference Authentication guide

Response schema

{
  "type": "object",
  "properties": {
    "accessToken": {
      "type": "string",
      "description": "Send as `Authorization: Bearer <accessToken>`. Prefixed `ms_oauth_`."
    },
    "tokenType": {
      "type": "string",
      "enum": [
        "Bearer"
      ]
    },
    "expiresIn": {
      "type": "integer",
      "description": "Lifetime in seconds (3600)."
    },
    "keyType": {
      "type": "string",
      "enum": [
        "full",
        "data"
      ],
      "description": "Mirrors the underlying key. `data` tokens are read-only market-data credentials."
    },
    "member": {
      "type": "object",
      "required": [
        "id",
        "email",
        "roleIds",
        "permissions",
        "status"
      ],
      "properties": {
        "id": {
          "type": "string"
        },
        "uid": {
          "type": "string"
        },
        "email": {
          "type": "string",
          "format": "email"
        },
        "displayName": {
          "type": [
            "string",
            "null"
          ]
        },
        "roleIds": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "permissions": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "status": {
          "type": "string",
          "enum": [
            "INVITED",
            "ACTIVE",
            "SUSPENDED",
            "REMOVED"
          ]
        },
        "activeSessionCount": {
          "type": "integer",
          "minimum": 0
        }
      }
    },
    "permissions": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "sessionId": {
      "type": "string"
    }
  }
}

curl -X POST 'https://mystocks.africa/api/v1/partner/session' \
  -H "Authorization: Bearer $FIREBASE_ID_TOKEN"

POST /sandbox/trade

GET /settings