> ## Documentation Index
> Fetch the complete documentation index at: https://docs.traza.com.au/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Session

> Creates a session cookie from a Firebase ID token. The cookie is set in the response headers and is valid for 5 days.



## OpenAPI

````yaml POST /auth/session
openapi: 3.1.0
info:
  title: Tatu API
  description: API documentation for Tatu's booking and artist management system
  version: 1.0.0
servers:
  - url: http://localhost:3000/api
    description: Development server
security: []
paths:
  /auth/session:
    post:
      summary: Create Session
      description: >-
        Creates a session cookie from a Firebase ID token. The cookie is set in
        the response headers and is valid for 5 days.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - idToken
              properties:
                idToken:
                  type: string
                  description: Firebase ID token to create session from
      responses:
        '200':
          description: >-
            Session created successfully. A session cookie is set in the
            response headers.
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                properties:
                  status:
                    type: string
                    enum:
                      - success
                    description: Status of the session creation
          headers:
            Set-Cookie:
              schema:
                type: string
                description: >-
                  Session cookie with HttpOnly, Secure, and SameSite=Strict
                  flags
        '401':
          description: Unauthorized - Invalid ID token
          content:
            application/json:
              schema:
                type: object
                required:
                  - error
                properties:
                  error:
                    type: string
                    enum:
                      - Unauthorized
                    description: Error message
        '405':
          description: Method not allowed - Only POST requests are accepted

````