See api-docs Menu

Create Session Via API Token

Post a session token to this API endpoint to start a session and set a cookie to log a user into an app.

This API endpoint works within a login flow in which your app server calls the Create Session Login Token API to generate a session token. The app login page posts the session token via the browser to the session_via_api_token endpoint, using either a form post or a CORS (Cross Origin Resource Sharing) request.

For detailed usage flows and examples that illustrate how this API works with the Create Session Login Token API to log in a user, see Logging a User in Via API.

Resource URL


Sample Request

HTML form post:

<!doctype html>
        <meta charset="utf-8">
        <p>Auth API Test</p>
        <form action=
         "https://{your_subdomain}" method="POST">
            <input type="hidden" name="session_token" value="{your session token value}">
            <input type="submit" placeholder="GO">
            <input id="auth_token" type="hidden">

CORS post:

If posted from the URL that was specified using the Custom-Allowed-Origin-Header-1 header when calling the Create Session Login Token API, the following will return a session cookie:

function makeCors(session_token) {
   var xhr = new XMLHttpRequest();
   xhr.withCredentials = true;
   method = "POST";
   var url = "https://<your_subdomain>";, url, true);
   xhr.setRequestHeader("Content-Type", "application/json");
   body = {"session_token": session_token};

Sample Response

In a successful response to a CORS request, the session_via_api_token endpoint simply sends a cookie which sets a session on the browser.

If the token is bad, the endpoint refuses the CORS request and the browser displays a “blocked by CORS policy” error message (whose content depends on the browser).

Usage Flows and Code Samples

See Logging a User In Via API.

Have a Question?

Have a how-to question? Seeing a weird error? Ask us about it on StackOverflow.

Found a bug? Submit a support ticket.

Have a product idea or request? Share it with us in our Ideas Portal.

StackOverflow discussions about "[onelogin] user login api"

  • 6

    Q: Verify AD or LDAP crendentials via REST API

    Asked Mar 28 2016

    with a login form on our web application, they will then enter their AD/LDAP username and password, which we would verify against their user directory using OneLogin API I went … through the API documentation for OneLogin but i have not see any method for doing that, although i can see at that it is a feature of OneLogin …

  • 2

    A: Accessing Third Party Apps After Creating A Session Via API Token

    Answered Mar 10 2017

    Two ways: If the app supports SP-initiated SAML, just navigate the user to the application and it'll do the whole SAML flow- App redirects to OneLogin - OL authenticates user (because you have a session … /1/embed-apps/get-apps-to-embed-for-a-user Take note that you're probably going to want to use the optional flag that makes sure to redirect to your login page, not OL's if you've built a login facade …

  • 2

    Q: OneLogin session_via_api_token and Chrome

    Asked Nov 14 2016

    This in turn calls the API method $.post("onelogin.ashx? … In Chrome the user is not logged in and the response header "Location" is I have a feeling it is a problem with cookies but can't figure out what. Any ideas? …

  • 2

    Q: OneLogin - how do I redirect to a custom login page upon session expiration?

    Asked Jun 15 2016

    According to the OneLogin documentation, I can use my own login form combined with their API to log users in. And that works fine until the session expires. … At that point, the next communication to the server redirects me to OneLogin's login page and not mine. Is it possible to redirect users back to my login page upon expiration? …

  • 2

    Q: failing to receive onedrive oauth refresh_token when authenticating through SSO

    Asked Feb 12 2018

    since they are using onelogin sso, they are redirected from onedrive to onelogin, they login to onelogin, and are redirected back to onedrive. … login to onelogin get redirected to onedrive grant permission for 3rd party app access get redirected back to app with access code exchange code for oauth tokens fail to receive refresh_token thanks …