Portal session token
A portal session token gives Bunny Components access to one account's data. Create one on your server with portalSessionCreate and pass it to BunnyProvider.
A portal session token gives access to one account’s billing data, and nothing else. Every component except <Signup /> needs one: the components find the account from the token, so you never pass an account ID.
Create the token on your server for the signed-in customer, then pass it to BunnyProvider as token.
Create a tokenLink to Create a token section
- Create an API client with the
portal:writescope, and get an access token for it. Keep this access token on your server. - Call
portalSessionCreatewith the customer’s tenant code.expiryis in hours (default and maximum 24). PassreturnUrlto show a link back to your app in the portal, which is also where customers are sent when their session has expired.
mutation portalSessionCreate($tenantCode: String!, $expiry: Int) {
portalSessionCreate(tenantCode: $tenantCode, expiry: $expiry) {
token
errors
}
}
With the Node SDK: await bunny.portalSessionCreate("superdesk-123").
- Send the returned
tokento the browser and render the components with it:
<BunnyProvider apiHost="https://acme.bunny.com" token={portalSessionToken}>
<BillingDetails />
</BunnyProvider>
When the token expires, BunnyProvider calls onTokenExpired. Fetch a new token from your server and render with it.
Portal session token or API client token?Link to Portal session token or API client token? section
| Portal session token | API client token | |
|---|---|---|
| Data access | One account | Your whole Bunny entity, limited by scopes |
| Use it in | The browser, with Bunny Components | Your server only |
| Used by components | All except <Signup /> |
<Signup /> only, with just the signup:read and signup:write scopes |
Never send an API client token with wider scopes to the browser. Anyone can read it from the page and reach all of your Bunny data.