Session token

Planned contract. The current sandbox does not create sessions or session tokens. Use the quickstart for supported check authorization and receipt verification.

A live session runs under a session token instead of an authorization token. POST /v1/sessions returns it as token, and renewing the session returns a new one. Each token lives 5 minutes, and the session is renewed every 60 seconds, so a revoked license stops a session at the next renewal even when the session stream is lost. The token is a JWS in compact serialization, signed with ES256.

{
  "alg": "ES256",
  "kid": "rfl-2026-10-docs3",
  "typ": "tlp-session+jwt"
}

typ is always tlp-session+jwt. kid names the signing key in the JWKS.

Claims

Claim	Type	Value
`iss`	string	`https://app.reflections.ai`
`aud`	string	The `acct_` ID of the platform that runs the session.
`sub`	string	The `acct_` ID of the licensee whose license the session runs under.
`jti`	string	The session ID, `ses_…`. The same in every renewed token.
`iat`	number	Issue time, in Unix seconds.
`exp`	number	Expiry, 5 minutes after `iat`. Equal to the session’s `expires_at`.
`tlp.ver`	string	The protocol version, `"1.0"`.
`tlp.session`	string	The session ID, `ses_…`.
`tlp.check`	string	The check that started the session, `chk_…`.
`tlp.talent`	string array	The `tal_` IDs the session covers.
`tlp.facets`	string array	The `fct_` IDs the session covers, such as one voice.
`tlp.licenses`	object array	The licenses the session runs under, as in the authorization token: one entry per talent whose license applied, in the order of `tlp.talent`, each with `talent`, `license`, `revision` and `terms_digest`. The same in every renewed token.
`tlp.use`	object	The session’s `use`.
`tlp.sampling`	object	The sampling the session must meet: `audio_window_max`, `transcript`, and for video `frame_interval`.
`tlp.eu`	string	An HMAC of the end user’s ID, in hex.

Example payload

A fan voice chat in Maya Okafor’s speaking voice, run by Northlight under its platform license:

{
  "iss": "https://app.reflections.ai",
  "aud": "acct_7p4r6s9t0wxyhk5zba2q8v1m3n",
  "sub": "acct_7p4r6s9t0wxyhk5zba2q8v1m3n",
  "jti": "ses_q8v1m3n7p4r6s9t0wxyhk5zba2",
  "iat": 1792260000,
  "exp": 1792260300,
  "tlp": {
    "ver": "1.0",
    "session": "ses_q8v1m3n7p4r6s9t0wxyhk5zba2",
    "check": "chk_n7p4r6s9t0wxyhk5zba2q8v1m3",
    "talent": ["tal_9t0wxyhk5zba2q8v1m3n7p4r6s"],
    "facets": ["fct_v1m3n7p4r6s9t0wxyhk5zba2q8"],
    "licenses": [
      {
        "talent": "tal_9t0wxyhk5zba2q8v1m3n7p4r6s",
        "license": "lic_ba2q8v1m3n7p4r6s9t0wxyhk5z",
        "revision": "lrv_7p4r6s9t0wxyhk5zba2q8v1m3n",
        "terms_digest": "sha256:8e0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8c0e2b4d6f8a0c2e4b6d8f0a"
      }
    ],
    "use": {
      "modality": "speech",
      "kind": "impersonation",
      "purpose": "personal",
      "commercial": false,
      "channels": ["in_app"],
      "territories": ["US"]
    },
    "sampling": { "audio_window_max": "PT15S", "transcript": "every_turn" },
    "eu": "3f9c1a7e5b2d8f4061c3e9a7b5d2f8016e4c9a3b7d1f5e2c8a6b4d0f9e3c7a15"
  }
}

Northlight holds this license itself, so aud and sub are the same account.

Renewal

	Value
Token lifetime	5 minutes
Renew every	`renew_every`, 60 seconds
Renewal returns	A new token and `expires_at`, with the same `jti`, `tlp.licenses` and `tlp.facets`
Renewal fails	`409 session_not_active` once the license is revoked, suspended or ends, or the session was terminated

On 409 session_not_active, stop output at once. On a network error, 429 or 5xx, keep retrying, and stop when the current token expires if no renewal succeeded. Pass each new token to the provider that runs the session; the provider stops when the token it holds expires and no newer one arrives.

Verify a token

A provider that runs a live voice or video session verifies the token before it starts, and each renewed token as it arrives. The steps are those for an authorization token, with these differences:

typ is tlp-session+jwt.
exp is 5 minutes after iat. Allow at most 60 seconds of leeway on exp and on iat.
tlp.session is the session you are running.
There is no tlp.max_generations and no tlp.execution. A session token covers one session, identified by jti, until it expires.
A renewed token must have the same jti, tlp.licenses and tlp.facets as the one it replaces.

The session token also authenticates a client on the session stream, as the subprotocol tlp.session.<token>, offered with tlp.session.v1. The stream checks the token once, when the connection opens; renewing over REST keeps the session and does not reconnect the stream.

Real-time sessions

Renewal, sampling, termination and the one-second stop.

Voice platforms

Licensed voices, scripts and live sessions.

Overview

Account

Talent

Facets

Resolutions

Licenses

License requests

Connections

Files

Checks

Generations

Sessions

Receipts

Verifications

Revocations

Usage records

Statements

Mandates

Escalations

License drafts

Webhook endpoints

Events

Discovery

OAuth

Test helpers

Webhooks

Real-time

Formats

MCP

Header

Claims

Example payload

Renewal

Verify a token

Real-time sessions

Voice platforms

​Header

​Claims

​Example payload

​Renewal

​Verify a token

​Related

Real-time sessions

Voice platforms

Header

Claims

Example payload

Renewal

Verify a token

Related