Master-token and short-lived client sessions
Exchange a private master token for a signed client session and validate TTL, identity, IP and rate limits.
Proplix Secure API Gateway
Open guide →GuideUnderstand the two-step portal flow
First create a client session with the private bearer token and contact_id, then call /me with the short-lived session token.
Open guide →GuideCall the session endpoint
POST /proplix_api_gateway/portal_api/session from the external backend.
Open guide →GuideUse POST for session creation
Other methods return 405.
Open guide →GuideSend the master bearer token
Use Authorization: Bearer {one-time token}.
Open guide →GuideSend contact_id
Identify an active CRM contact; the gateway resolves its customer account.
Open guide →GuideSet optional expires_in
Default 600 seconds; minimum 60 and maximum 900 seconds.
Open guide →GuideUnderstand session identity
The signed payload contains client ID, contact ID, profile/audience context, nonce and issued/expiry timestamps.
Open guide →GuideUnderstand signed session tokens
The production model signs the session and rejects invalid signatures/payloads.
Open guide →GuideRead session response
Use success, session token, expires_in and expires_at values.
Open guide →GuideResolve invalid master token
Check exact bearer token, active profile and one-way hash match.
Open guide →GuideResolve server IP rejection
Call from an allowed IP or update the profile whitelist.
Open guide →GuideResolve session rate limiting
Wait for the minute window or adjust the administrator rate limit within 10–1000.
Open guide →GuideResolve invalid contact
Use an active contact with a valid linked customer.
Open guide →GuideResolve expired client session
Create a new session; sessions are deliberately short-lived and not refreshed by /me.
Open guide →