Open an Anonymous Session
curl --request POST \
--url https://api.example.com/api/v1/sdk/anonymous-session \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"email": "<string>"
}
'import requests
url = "https://api.example.com/api/v1/sdk/anonymous-session"
payload = {
"name": "<string>",
"email": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', email: '<string>'})
};
fetch('https://api.example.com/api/v1/sdk/anonymous-session', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/sdk/anonymous-session",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'email' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v1/sdk/anonymous-session"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"email\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/sdk/anonymous-session")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"email\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v1/sdk/anonymous-session")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"email\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"data.token": "<string>",
"data.conversation_id": "<string>",
"data.user_id": "<string>",
"data.expires_in": 123
}Provisioning
Open an Anonymous Session
Provision a support session from the browser with only a public key — no backend.
POST
/
api
/
v1
/
sdk
/
anonymous-session
Open an Anonymous Session
curl --request POST \
--url https://api.example.com/api/v1/sdk/anonymous-session \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"email": "<string>"
}
'import requests
url = "https://api.example.com/api/v1/sdk/anonymous-session"
payload = {
"name": "<string>",
"email": "<string>"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({name: '<string>', email: '<string>'})
};
fetch('https://api.example.com/api/v1/sdk/anonymous-session', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/sdk/anonymous-session",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'email' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v1/sdk/anonymous-session"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"email\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/sdk/anonymous-session")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"email\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v1/sdk/anonymous-session")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"email\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"data.token": "<string>",
"data.conversation_id": "<string>",
"data.user_id": "<string>",
"data.expires_in": 123
}Overview
Opens a support session directly from the browser using only your app’s public key — no backend required. The endpoint validates the requestOrigin against your app’s allow-list,
mints an SDK token, and creates a SUPPORT conversation. This powers the widget’s anonymous
mode for static sites.
Auth:
X-Api-Key: pk_… (public key only). The request Origin must be listed in the
app’s allowed origins (dashboard → app settings). No secret key is used or needed.Anonymous embedding is disabled by default. Add each site’s origin (e.g.
https://www.example.com) to the app’s allowed origins first, or this endpoint returns 403.Request Headers
| Header | Required | Description |
|---|---|---|
X-Api-Key | Yes | App public key (pk_…) |
Origin | Yes | Set automatically by the browser; must be allow-listed |
Content-Type | Yes | application/json |
Request Body
string
Visitor display name (optional).
string
Visitor email (optional; can be collected later via Update Visitor).
Example Request
curl -X POST https://dev.vocantly.com/api/v1/sdk/anonymous-session \
-H "Content-Type: application/json" \
-H "Origin: https://www.example.com" \
-H "X-Api-Key: pk_xxxxx" \
-d '{ "name": "Guest" }'
Response
string
SDK token for this anonymous visitor.
string
The support conversation to join.
string
Generated anonymous visitor ID.
number
Token lifetime in seconds.
Success (201)
{
"success": true,
"data": {
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"conversation_id": "b2c8…",
"user_id": "anon_9f3a…",
"expires_in": 86400
}
}
Notes
- Rate limited per IP to prevent abuse.
- The widget calls this for you when you pass only a
publicKey— see Embed the widget. You rarely call it directly.
Error Responses
| Status | Meaning |
|---|---|
403 Forbidden | Origin not in the app’s allowed origins, or anonymous embedding disabled |
401 Unauthorized | Invalid public key |
429 Too Many Requests | Rate limit exceeded |
Embed the widget
Anonymous mode with a public key.
Server-side session
Provision from your backend instead.