Run a verified unlock session.

Reference the same-origin endpoints used by the LinkCode resolver to create sessions, post ordered playback signals and request verification.

1. Start after user intent

POST/api/v1/unlock/sessionsLive

PropertyTypeDescription

codestringrequired

The normalized or human-entered LinkCode.

const session = await fetch("/api/v1/unlock/sessions", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ code: "LAUNCH26" })
}).then((response) => response.json());

2. Post ordered playback events

POST/api/v1/unlock/sessions/{sessionId}/eventsLive

PropertyTypeDescription

sessionTokenopaque stringrequired

Short-lived secret returned only to the active browser.

sequenceintegerrequired

Strictly increasing event number starting at 1.

eventTypeenumrequired

started, heartbeat, paused, resumed, stalled, fullscreen_exit, hidden, cancelled or completed.

clientPositionMsintegerrequired

Playback position used as a consistency signal, not as authoritative time.

3. Verify and consume

POST/api/v1/unlock/sessions/{sessionId}/completeLive

Successful verification returns an internal /u/{token} URL. The token expires after five minutes, is consumed once and performs the final server-side redirect.