> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Token Berbagi Sesi API: Buat Share Token > Didit POST /v3/session/{id}/share/ membuat token berbagi untuk KYC yang dapat digunakan kembali. Bertanda tangan JWT, bayar per panggilan. Prompt Berbagi Sesi Salin prompt ke papan klip \

\`Mint a short-lived share token so another Didit application can import this finished verification session (Reusable KYC / KYB).

Endpoint:
POST https://verification.didit.me/v3/session/{session_id}/share/

Authentication:
Use the x-api-key header with your Didit API key. Privilege: write:sessions.

Path parameter:
\- session_id (UUID) — works for both User Verification (KYC) and Business Verification (KYB).

Request body:
\- for_application_id (string, UUID, required) — UUID of the receiving Didit application. Must exist, must not be deleted, and must be different from the calling application.
\- ttl_in_seconds (integer, optional, default 3600) — Lifetime of the share token. Min 60, max 86400 (24 hours).

Prerequisites:
\- Session status must be one of "Approved", "Declined", "In Review". Any other status returns 400 ("Only finished sessions ... can be shared.").

curl example:
curl -X POST https://verification.didit.me/v3/session//share/ \
-H "x-api-key: " \
-H "Content-Type: application/json" \
-d '{
"for_application_id": "",
"ttl_in_seconds": 3600
}'

Response:
\- share_token (string) — HS256-signed JWT with payload { session_id, session_kind, from_application_id, for_application_id, iat, exp }.
\- for_application_id (UUID) — echoed back.
\- session_kind ("user" | "business") — embedded so the receiver clones the right kind.

Token characteristics:
\- Bound to for_application_id — only that application can redeem it via POST /v3/session/import-shared/.
\- Cannot be revoked via API — it simply expires after ttl_in_seconds.
\- You can mint multiple tokens for the same session (e.g. one per partner). Each call returns a fresh JWT with a new iat.

Failure modes:
\- 400 — { "detail": "Only finished sessions ... can be shared." } when the session isn't Approved/Declined/In Review.
\- 400 — { "for_application_id": ["..."] } for unknown or self application UUIDs.
\- 401 — invalid API key.
\- 403 — { "detail": "You do not have permission to perform this action." } when the key lacks write:sessions.
\- 404 — { "detail": "Not found." } when the session_id is not visible to this application.

Send the share_token to the receiving partner through your own secure channel (HTTPS API call, webhook, signed email link, etc.).

Next step:
The receiving application calls POST https://verification.didit.me/v3/session/import-shared/ with the share_token to clone the session — see /sessions-api/share-session/import.

For end-to-end Didit integration, paste in the full prompt at /integration/integration-prompt.`

\
Tempel ke ## Dukungan KYC dan KYBBerlaku untuk sesi **Verifikasi Pengguna (KYC)** dan **Verifikasi Bisnis (KYB)**. Didit mencocokkan `session_id` dengan kedua jenis sesi dan membuat token JWT untuk berbagi yang mencakup:```json theme={null} { "session_id": "...", "session_kind": "user" | "business", "from_application_id": "...", "for_application_id": "...", "iat": ..., "exp": ... } ```Saat mitra penerima mengimpor token, Didit menduplikasi sesi yang sesuai (KYC atau KYB) beserta relasinya.## Persyaratan- Sesi harus berada dalam status **selesai** (`APPROVED`, `DECLINED`, `IN_REVIEW`). - Anda harus memiliki izin `write:sessions`. - `for_application_id` harus berupa aplikasi Didit yang valid (biasanya aplikasi milik mitra).## Contoh> [tab] Bagikan sesi Verifikasi Pengguna (KYC) > > ```bash theme={null} > curl -X POST https://verification.didit.me/v3/session/4c5c7f3a-.../share/ \ > -H "x-api-key: YOUR_API_KEY" \ > -H "Content-Type: application/json" \ > -d '{ > "for_application_id": "partner-app-uuid", > "ttl_in_seconds": 3600 > }' > ``` > > **Respons:** > > ```json theme={null} > { > "share_token": "eyJhbGciOiJIUzI1NiJ9...", > "for_application_id": "partner-app-uuid", > "session_kind": "user" > } > ```> [tab] Bagikan sesi Verifikasi Bisnis (KYB) > > ```bash theme={null} > curl -X POST https://verification.didit.me/v3/session/bs-01HJX1.../share/ \ > -H "x-api-key: YOUR_API_KEY" \ > -H "Content-Type: application/json" \ > -d '{ > "for_application_id": "partner-app-uuid", > "ttl_in_seconds": 7200 > }' > ``` > > **Respons:** > > ```json theme={null} > { > "share_token": "eyJhbGciOiJIUzI1NiJ9...", > "for_application_id": "partner-app-uuid", > "session_kind": "business" > } > ```## Batas TTL| Parameter | Min | Maks | Default | | - | - | - | - | | `ttl_in_seconds` | 60 | 86400 | 3600 |## Terkait- [Impor sesi yang dibagikan](https://docs.didit.me/id/sessions-api/share-session/import.md) - [Panduan KYC yang Dapat Digunakan Kembali](https://docs.didit.me/id/core-technology/reusable-kyc/share-kyc-via-api.md) - [Ikhtisar sesi](https://docs.didit.me/id/sessions-api/overview.md) ## OpenAPI ````yaml id/openapi-25.json POST /v3/session/{sessionId}/share/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: API Verifikasi Identitas. Lakukan autentikasi dengan header x-api-key. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/session/{sessionId}/share/: post: tags: - Sessions summary: Buat token berbagi untuk sesi verifikasi yang telah selesai description: >- Buat JWT berumur pendek yang memungkinkan aplikasi Didit tertentu mengimpor sesi yang telah selesai ini. Pasangkan dengan `POST /v3/session/import-shared/`. operationId: post_v3_session_share parameters: - in: path name: sessionId required: true description: UUID sesi verifikasi sumber untuk mencetak token. schema: type: string format: uuid example: 11111111-2222-3333-4444-555555555555 requestBody: required: true content: application/json: schema: type: object required: - for_application_id properties: for_application_id: type: string format: uuid description: >- UUID aplikasi Didit yang akan menukarkan token. Harus ada, tidak boleh dihapus, dan harus berbeda dari aplikasi pemanggil. Temukan di Business Console di bawah **Settings → Application**. example: a5f3bca2-46e2-411e-90ef-a580900a57ee ttl_in_seconds: type: integer description: >- Masa berlaku token, dalam detik. Minimum `60`, maksimum `86400` (24 jam). Defaultnya `3600` (1 jam). minimum: 60 maximum: 86400 default: 3600 example: 3600 example: for_application_id: a5f3bca2-46e2-411e-90ef-a580900a57ee ttl_in_seconds: 7200 responses: '200': description: Token berbagi telah dicetak. content: application/json: schema: type: object properties: share_token: type: string description: >- JWT bertanda tangan HS256. Teruskan ini secara persis apa adanya sebagai `share_token` ke [`POST /v3/session/import-shared/`](/sessions-api/import-shared-session) pada aplikasi target. example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... for_application_id: type: string format: uuid description: >- Menampilkan kembali UUID aplikasi target yang terikat dengan token tersebut. example: a5f3bca2-46e2-411e-90ef-a580900a57ee session_kind: type: string enum: - user - business description: >- Apakah sesi sumber merupakan sesi Verifikasi Pengguna (KYC) atau Verifikasi Bisnis (KYB). examples: User session: summary: Bagikan sesi KYC value: share_token: >- eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzZXNzaW9uX2lkIjoiMjBiYjNjM2ItNjE0Ni00MzlmLTg0YTQtYmQzMGQwMGFjNmEyIiwiZnJvbV9hcHBsaWNhdGlvbl9pZCI6ImRiZDIwZTM0LTQyZTktNGYyYy1iYTkxLWNmMDc2MjAxNmY2NCIsImZvcl9hcHBsaWNhdGlvbl9pZCI6ImE1ZjNiY2EyLTQ2ZTItNDExZS05MGVmLWE1ODA5MDBhNTdlZSIsImlhdCI6MTc1MzYzMDY2NiwiZXhwIjoxNzUzNjM0MjY2fQ.JJ9pNE_hqZsOtbR0XYZIWw4JzidjdEl279iUrsIkhGE for_application_id: a5f3bca2-46e2-411e-90ef-a580900a57ee session_kind: user Business session: summary: Bagikan sesi KYB value: share_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... for_application_id: a5f3bca2-46e2-411e-90ef-a580900a57ee session_kind: business '400': description: >- Kesalahan validasi. Kesalahan pada kolom menggunakan nama kolom sebagai kunci; kesalahan belum selesai muncul di bawah kunci `detail` (sebagai array). content: application/json: examples: Wrong status: summary: Sesi sumber belum selesai value: detail: - >- Only finished sessions ("Approved", "Declined", "In Review") can be shared. Target missing: summary: Aplikasi target tidak ada value: for_application_id: - Target application does not exist. Self-share: summary: Target adalah aplikasi pemanggil value: for_application_id: - Cannot share a session with the same application. TTL bounds: summary: ttl_in_seconds di luar batas value: ttl_in_seconds: - Ensure this value is greater than or equal to 60. '401': description: >- Kredensial tidak ada atau tidak valid. Tidak seperti sebagian besar endpoint v3, endpoint ini mengautentikasi melalui dekorator izin dan mengembalikan `401` saat tidak ada token/kunci valid yang diberikan. content: application/json: examples: Unauthorized: summary: Tidak diotorisasi value: detail: >- Authentication credentials were not provided or are invalid. '403': description: >- Kredensial valid tetapi tidak memiliki izin `write:sessions` untuk aplikasi ini. content: application/json: examples: No Permission: summary: Tidak Ada Izin value: detail: You do not have permission to perform this action. '404': description: Tidak ada sesi dengan `session_id` yang diberikan di aplikasi Anda. content: application/json: examples: Not Found: summary: Sesi tidak ditemukan value: detail: Not found. security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: |- curl -X POST \ https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/share/ \ -H 'x-api-key: YOUR_API_KEY' \ -H 'Content-Type: application/json' \ -d '{ "for_application_id": "a5f3bca2-46e2-411e-90ef-a580900a57ee", "ttl_in_seconds": 7200 }' - lang: python label: Python source: |- from didit import Didit # Reads DIDIT_API_KEY. client = Didit() result = client.sessions.share( "11111111-2222-3333-4444-555555555555", for_application_id="a5f3bca2-46e2-411e-90ef-a580900a57ee", ttl_in_seconds=7200, ) print(result) - lang: javascript label: Node.js source: >- import Didit from "@didit-protocol/sdk-node"; // Reads DIDIT_API_KEY. const didit = new Didit(); const result = await didit.sessions.share("11111111-2222-3333-4444-555555555555", { for_application_id: "a5f3bca2-46e2-411e-90ef-a580900a57ee", ttl_in_seconds: 7200, }); console.log(result); - lang: go label: Go source: "ctx := context.Background()\n// Reads DIDIT_API_KEY.\nclient := didit.NewClient()\n\nresult, err := client.Sessions.Share(ctx, \"11111111-2222-3333-4444-555555555555\", didit.SessionsShareParams{\n\tForApplicationID: \"a5f3bca2-46e2-411e-90ef-a580900a57ee\",\n\tTTLInSeconds: didit.Int(7200),\n})\nif err != nil {\n\tlog.Fatal(err)\n}\nfmt.Printf(\"%+v\\n\", result)" - lang: java label: Java source: >- import me.didit.Didit; import me.didit.types.SessionsShareParams; // Reads DIDIT_API_KEY. Didit client = new Didit(); var result = client.sessions().share("11111111-2222-3333-4444-555555555555", SessionsShareParams.builder() .forApplicationId("a5f3bca2-46e2-411e-90ef-a580900a57ee") .ttlInSeconds(7200L) .build()); System.out.println(result); - lang: php label: PHP source: >- sessions->share('11111111-2222-3333-4444-555555555555', [ 'for_application_id' => 'a5f3bca2-46e2-411e-90ef-a580900a57ee', 'ttl_in_seconds' => 7200, ]); print_r($result->toArray()); - lang: ruby label: Ruby source: |- require "didit" # Reads DIDIT_API_KEY. didit = Didit::Client.new result = didit.sessions.share( "11111111-2222-3333-4444-555555555555", for_application_id: "a5f3bca2-46e2-411e-90ef-a580900a57ee", ttl_in_seconds: 7200 ) puts result.to_h - lang: csharp label: .NET source: >- using System; using System.Text.Json; using Didit; // Reads DIDIT_API_KEY. using var client = new DiditClient(); var result = await client.Sessions.ShareAsync("11111111-2222-3333-4444-555555555555", new SessionsShareParams { ForApplicationId = "a5f3bca2-46e2-411e-90ef-a580900a57ee", TtlInSeconds = 7200, }); Console.WriteLine(JsonSerializer.Serialize(result)); components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Kunci API aplikasi Anda, dari Developers -> API keys di Business Console. Kunci utama memiliki akses penuh. Kunci bernama dapat diberi cakupan: none, read, atau write per sumber daya, dibatasi pada beberapa alur kerja atau pada sesi yang disetujui, pada daftar alamat IP, dan pada tanggal kedaluwarsa. 401 berarti kuncinya salah, dicabut, atau kedaluwarsa; 403 berarti tidak ada kunci yang dikirimkan, kunci tidak memiliki akses ke sumber daya atau tindakan ini, atau permintaan datang dari alamat di luar daftar IP-nya; 404 pada rute sesi berarti sesi berada di luar alur kerja atau status kunci tersebut. Kunci tanpa akses media menerima URL gambar, video, dan PDF sebagai null, dan kunci tanpa izin tulis sesi menerima tautan sesi dan token sebagai null. Lihat https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.