Portal session token

A portal session token gives Bunny Components access to one account's data. Create one on your server with portalSessionCreate and pass it to BunnyProvider.

A portal session token gives access to one account’s billing data, and nothing else. Every component except <Signup /> needs one: the components find the account from the token, so you never pass an account ID.

Create the token on your server for the signed-in customer, then pass it to BunnyProvider as token.

Create a tokenLink to Create a token section

  1. Create an API client with the portal:write scope, and get an access token for it. Keep this access token on your server.
  2. Call portalSessionCreate with the customer’s tenant code. expiry is in hours (default and maximum 24). Pass returnUrl to show a link back to your app in the portal, which is also where customers are sent when their session has expired.
mutation portalSessionCreate($tenantCode: String!, $expiry: Int) {
  portalSessionCreate(tenantCode: $tenantCode, expiry: $expiry) {
    token
    errors
  }
}

With the Node SDK: await bunny.portalSessionCreate("superdesk-123").

  1. Send the returned token to the browser and render the components with it:
<BunnyProvider apiHost="https://acme.bunny.com" token={portalSessionToken}>
  <BillingDetails />
</BunnyProvider>

When the token expires, BunnyProvider calls onTokenExpired. Fetch a new token from your server and render with it.

Portal session token or API client token?Link to Portal session token or API client token? section

  Portal session token API client token
Data access One account Your whole Bunny entity, limited by scopes
Use it in The browser, with Bunny Components Your server only
Used by components All except <Signup /> <Signup /> only, with just the signup:read and signup:write scopes

Never send an API client token with wider scopes to the browser. Anyone can read it from the page and reach all of your Bunny data.