Authentication

The SDK connects directly to AvatarFactory's servers, so every connection needs a token. The secure, production-recommended flow is to have your backend exchange your secret API key for a short-lived session token, and hand that token to the SDK. Your key stays on your server; the browser only ever sees a single-use token.

How the flow works

The token endpoint

POST https://api.avatarfactory.in/v1/session/token
Authorization: Bearer <YOUR_SECRET_API_KEY>
Content-Type: application/json

{ "avatarId": "default" }

Request body

Successful response — 200 OK

{ "sessionToken": "<short-lived session token>" }

Common errors

Example: your backend endpoint

Your endpoint receives an avatarId from your frontend, calls AvatarFactory with your secret key, and returns the token. Pick your stack below — it's the same minimal endpoint, adapt it to your framework.

curl -X POST https://api.avatarfactory.in/v1/session/token \
-H "Authorization: Bearer $AVATAR_FACTORY_KEY" \
-H "Content-Type: application/json" \
-d '{ "avatarId": "default" }'

Wire it to the SDK

Point the SDK's getSessionToken at the endpoint you just built. The SDK reads sessionToken from the response:

<AvatarProvider
  config={{
    getSessionToken: async () => {
      const res = await fetch("/avatar-token", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ avatarId: "default" }),
      });
      const { sessionToken } = await res.json();
      return sessionToken;
    },
    avatar: { avatarId: "default" },
  }}
>
  ...
</AvatarProvider>

See AvatarProvider → Authentication for the full getSessionToken contract and the deployId / apiKey alternatives.