> ## Documentation Index
> Fetch the complete documentation index at: https://docs.warmr.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange a wk_live_ API key for a short-lived org session.

> Send the Supabase publishable/anon key in the `apikey` header (the edge function
requires it). Returns an org-scoped session JWT used as the Bearer token for /v1.




## OpenAPI

````yaml /api/openapi.yaml post /functions/v1/exchange-api-key-for-session
openapi: 3.1.0
info:
  title: Warmr Cloud API
  version: '1.2'
  summary: Enqueue and read iPhone-fleet automation work (warmups + posts).
  description: >
    The business-facing REST surface for Warmr. **Bring-your-own-fleet**: API
    keys

    *enqueue* work and read org-scoped state; your own connected iPhones
    *execute* it.

    A server-side **airlock** prevents an API session from ever driving a
    device.


    Auth is a two-step flow: exchange a `wk_live_` API key at the exchange
    endpoint for a

    short-lived org session, then call `/v1` with `Authorization: Bearer
    <access_token>`.


    Every `/v1` response is wrapped in an envelope `{ "schema": "1.0", ... }`;
    errors are

    `{ "schema": "1.0", "error": { "code", "message", "data"? } }`. The exchange
    endpoint

    uses a flatter `{ "error": "<code>" }` body.


    NOTE: the public base URL is deployment-specific and is NOT asserted here.
    Replace the

    `app.warmr.so` / `<project-ref>` placeholders below with your deployment's
    values.
  license:
    name: UNLICENSED
servers:
  - url: https://{origin}
    description: Substitute your Warmr deployment origin. app.warmr.so is a placeholder.
    variables:
      origin:
        default: app.warmr.so
        description: Your Warmr deployment host, no scheme, e.g. app.example.com
security:
  - bearerAuth: []
tags:
  - name: auth
    description: Exchange an API key for an org session.
  - name: runs
    description: >-
      Enqueue and read units of automation work (warm_up or post); your
      connected iPhones execute them.
  - name: schedules
    description: >-
      Standing recurring post schedules (one account each). The materializer
      turns them into runs.
  - name: accounts
    description: Register and list the social account handles in your org.
  - name: content
    description: >-
      Signed direct-to-storage uploads for post clips (issue → upload →
      confirm).
  - name: usage
    description: Org storage and run counts for a billing period.
  - name: devices
    description: The iPhones your runner(s) have reported to the org.
  - name: webhooks
    description: >-
      Subscribe to run.completed / run.failed events and manage deliveries.
      Opt-in, secret-bearing (webhooks:read / webhooks:write).
  - name: keys
    description: >-
      List your org's API keys — metadata only, the secret is never returned.
      Opt-in keys:read.
  - name: health
    description: Lightweight org-scoped readiness probe. Opt-in health:read.
paths:
  /functions/v1/exchange-api-key-for-session:
    servers:
      - url: https://{projectRef}.supabase.co
        variables:
          projectRef:
            default: project-ref
            description: Your Supabase project ref.
    post:
      tags:
        - auth
      summary: Exchange a wk_live_ API key for a short-lived org session.
      description: >
        Send the Supabase publishable/anon key in the `apikey` header (the edge
        function

        requires it). Returns an org-scoped session JWT used as the Bearer token
        for /v1.
      operationId: exchangeApiKey
      parameters:
        - $ref: '#/components/parameters/SupabaseApiKeyHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExchangeRequest'
      responses:
        '200':
          description: Session minted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExchangeResponse'
        '400':
          description: Missing/invalid JSON or missing api_key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExchangeError'
        '403':
          description: Invalid or revoked API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExchangeError'
        '429':
          description: Rate limited (30/IP/hr or 1000/key/day).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExchangeError'
        '503':
          description: Exchange backend not yet provisioned (fails closed).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExchangeError'
      security: []
components:
  parameters:
    SupabaseApiKeyHeader:
      name: apikey
      in: header
      required: true
      description: The Supabase publishable/anon key (required by the edge function).
      schema:
        type: string
  schemas:
    ExchangeRequest:
      type: object
      required:
        - api_key
      properties:
        api_key:
          type: string
          pattern: ^wk_(live|test)_[A-Za-z0-9]{16,}$
    ExchangeResponse:
      type: object
      required:
        - access_token
        - refresh_token
        - expires_at
        - org_id
        - supabase_url
        - anon_key
      properties:
        access_token:
          type: string
        refresh_token:
          type: string
        expires_at:
          type: integer
          description: UNIX epoch SECONDS at which access_token expires.
        org_id:
          type: string
        supabase_url:
          type: string
          format: uri
        anon_key:
          type: string
    ExchangeError:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          description: A flat error code (e.g. invalid_api_key, rate_limited).
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: The access_token from the exchange endpoint.

````