> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resurs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Session

> Creates a secure session for payment method integration. This endpoint is intended
for merchant backends to generate sessions that can be safely used by payment method
components in web applications. The session ID provides secure access to payment methods
without exposing sensitive merchant credentials.

**Authentication Required**: JWT Bearer token for merchant authentication
**Intended for**: Merchant backend systems
**Security**: Sessions are time-limited and scoped to specific stores




## OpenAPI

````yaml /api/payment-widget/openapi.json post /stores/{storeId}/sessions
openapi: 3.0.3
info:
  title: Payment Methods API
  description: >
    API for integrating Resurs Bank payment methods into web applications.

    Provides secure session management and payment method configuration for
    e-commerce platforms.


    ## Authentication


    | API | Auth Method |

    |-----|-------------|

    | Sessions | JWT Bearer token (merchant credentials) |

    | Payment Methods | Session ID (from session creation) |
  version: v1
  contact:
    name: Resurs Bank
    email: rf-checkout-experience@resurs.se
servers:
  - url: https://api.checkout.int.resurs.cloud/mock/payment/public/v1
    description: Mock
security: []
tags:
  - name: Sessions
    description: Create sessions for payment method integration
  - name: Payment Methods
    description: Retrieve available payment methods
paths:
  /stores/{storeId}/sessions:
    post:
      tags:
        - Sessions
      summary: Create Session
      description: >
        Creates a secure session for payment method integration. This endpoint
        is intended

        for merchant backends to generate sessions that can be safely used by
        payment method

        components in web applications. The session ID provides secure access to
        payment methods

        without exposing sensitive merchant credentials.


        **Authentication Required**: JWT Bearer token for merchant
        authentication

        **Intended for**: Merchant backend systems

        **Security**: Sessions are time-limited and scoped to specific stores
      operationId: createSession
      parameters:
        - $ref: '#/components/parameters/storeId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/createSessionRequest'
      responses:
        '200':
          description: Session successfully created with token and expiration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/sessionResponse'
        '400':
          $ref: '#/components/responses/badRequest'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '500':
          $ref: '#/components/responses/internalServerError'
      security:
        - bearerAuth: []
components:
  parameters:
    storeId:
      name: storeId
      in: path
      required: true
      description: The unique identifier of the store resource.
      schema:
        type: string
        example: 550e8400-e29b-41d4-a716-446655440000
  schemas:
    createSessionRequest:
      type: object
      properties:
        campaign:
          type: string
          description: >
            Optional campaign keyword to filter payment methods.

            When provided, only payment methods matching this campaign keyword
            will be returned.

            When omitted, only non-campaign payment methods are returned.
          example: SUMMER_SALE
    sessionResponse:
      type: object
      properties:
        id:
          type: string
          description: |
            Session ID for authenticating payment method requests.
            Use this ID for subsequent API calls.
          example: 550e8400-e29b-41d4-a716-446655440000
        expiresAt:
          type: string
          format: date-time
          description: >
            Session expiration timestamp in ISO 8601 format.

            After this time, the session will no longer be valid for API
            requests.
          example: '2025-11-17T15:30:00Z'
        embed:
          $ref: '#/components/schemas/embed'
      required:
        - id
        - expiresAt
        - embed
    embed:
      type: object
      description: >
        Contains the script URL that merchants use to load payment method
        components in their storefront.
      properties:
        src:
          type: string
          format: uri
          description: Fully qualified URL to the payment method components script.
          example: >-
            https://static.checkout.dev.resurs.cloud/payment/abc1234/resurs-payment-elements.js
      required:
        - src
    errorResponse:
      type: object
      properties:
        message:
          type: string
          description: A human-readable description of the error
          example: Session not found
      required:
        - message
  responses:
    badRequest:
      description: >-
        Bad Request - The request could not be understood or was missing
        required parameters
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/errorResponse'
          example:
            message: The request could not be understood due to malformed syntax
    unauthorized:
      description: Unauthorized - Authentication failed or token is invalid/expired
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/errorResponse'
          example:
            message: Invalid or expired authentication token
    forbidden:
      description: Forbidden - Valid authentication but insufficient permissions
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/errorResponse'
          example:
            message: You do not have permission to access this resource
    internalServerError:
      description: Internal Server Error - An unexpected error occurred on the server
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/errorResponse'
          example:
            message: An unexpected error occurred while processing your request
  securitySchemes:
    bearerAuth:
      type: apiKey
      name: Authorization
      in: header
      description: JWT token for merchant authentication
      x-amazon-apigateway-authtype: custom
      x-amazon-apigateway-authorizer:
        type: request
        authorizerUri: authorizerFunction
        authorizerResultTtlInSeconds: 0
        identitySource: method.request.header.Authorization

````