coss.comdocs

Create a signing session

POST
/v1/sign/requests/{id}/signers/{signer_id}/sessions

A short-lived link to the signing page for one embedded signer of a sent request. Your app vouches for who the signer is (the audit trail records customer_asserted), so create it only for that signed-in user, when they open the page that shows it. Embed the url in an iframe from an origin in your Sign settings' allowed_origins (mountSigning from coss/sign does it), or redirect to it. Each call creates a new session.

Authorization

bearerAuth
headerAuthorizationBearer <token>

A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.

Path Parameters

id*string

The signature request's id.

signer_id*string

The signer's id (signers[].id of the request).

Header Parameters

Coss-Version?"2026-10-10"

The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.

Value in"2026-10-10"

Request Body

application/json
  1. body
expires_in?integer

Seconds until the link expires: default 3600, at most 86400. Mint one when your user opens the page that shows it.

Range60 <= value <= 86400

Response Body

The session, with its link.

application/json
  1. response
object*"sign_session"
Value in"sign_session"
id*string
request_id*string
signer_id*string
url*string

The signing page: embed it in an iframe (from an allowed origin, with coss/sign's mountSigning) or redirect to it. The token is in the URL fragment, so it never reaches a server log: show it only to that signer.

token*string

The secret part of url, shown only here.

expires_at*string
Formatdate-time
import { Coss } from "coss";const coss = new Coss({  apiKey: process.env.COSS_API_KEY,  baseUrl: "https://api.coss.com",});const { data, error } = await coss.sign.sessions.create("sreq_01k7c8m4q2f3e9v6t5r1n0p8yz", "ssgn_01k7c8m4q2f3e9v6t5r1n0p8yz", {  expires_in: 3600,});
{  "object": "sign_session",  "id": "sgs_01k7c8m4q2f3e9v6t5r1n0p8yz",  "request_id": "sreq_01k7c8m4q2f3e9v6t5r1n0p8yz",  "signer_id": "ssgn_01k7c8m4q2f3e9v6t5r1n0p8yz",  "url": "https://sign.example/s/sgs_01k7c8m4q2f3e9v6t5r1n0p8yz#cosss_…",  "token": "cosss_…",  "expires_at": "2026-10-26T15:04:05.000Z"}