Master-token and short-lived client sessions
Exchange a private master token for a signed client session and validate TTL, identity, IP and rate limits.
Guides in this workflow
Follow the guide that matches the exact action, filter, menu change or issue.
Understand the two-step portal flow
First create a client session with the private bearer token and contact_id, then call /me with the short-lived session token.
Call the session endpoint
POST /proplix_api_gateway/portal_api/session from the external backend.
Use POST for session creation
Other methods return 405.
Send the master bearer token
Use Authorization: Bearer {one-time token}.
Send contact_id
Identify an active CRM contact; the gateway resolves its customer account.
Set optional expires_in
Default 600 seconds; minimum 60 and maximum 900 seconds.
Understand session identity
The signed payload contains client ID, contact ID, profile/audience context, nonce and issued/expiry timestamps.
Understand signed session tokens
The production model signs the session and rejects invalid signatures/payloads.
Read session response
Use success, session token, expires_in and expires_at values.
Resolve invalid master token
Check exact bearer token, active profile and one-way hash match.
Resolve server IP rejection
Call from an allowed IP or update the profile whitelist.
Resolve session rate limiting
Wait for the minute window or adjust the administrator rate limit within 10–1000.
Resolve invalid contact
Use an active contact with a valid linked customer.
Resolve expired client session
Create a new session; sessions are deliberately short-lived and not refreshed by /me.