curl --request POST \
--url https://api.voice.mergenlab.ai/v1/web-sessions \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"agent": {
"id": "u_123",
"name": "Priya"
},
"ttl_sec": 3600
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({agent: {id: 'u_123', name: 'Priya'}, ttl_sec: 3600})
};
fetch('https://api.voice.mergenlab.ai/v1/web-sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.voice.mergenlab.ai/v1/web-sessions"
payload = {
"agent": {
"id": "u_123",
"name": "Priya"
},
"ttl_sec": 3600
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"session_id": "wbs_6c1f0e2d3b4a4c5d9e8f7a6b5c4d3e2f",
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXAiOiJ3ZWIiLCJzaWQiOiJ3YnNfNmMxZjBlMmQzYjRhNGM1ZDllOGY3YTZiNWM0ZDNlMmYiLCJ0aWQiOiJ0ZW5fY3JlZGZpbiIsImFnZW50IjoidV8xMjMiLCJpYXQiOjE3OTE3OTkyMDAsImV4cCI6MTc5MTgwMjgwMH0._4pQfhoTeCf5dd2dhkdmImbxf0aXBCg_U4pbpwlwFXc",
"expires_at": "2026-10-12T11:00:00.000Z",
"agent": {
"id": "u_123",
"name": "Priya"
}
}Create a web session for a browser agent
Server to server, with your API key. Mints a short-lived token that lets one of your agents place web calls
from a browser (/v1/web/*, the @mergenlab/voice-web SDK). Send the token only to that agent’s browser.
Several sessions per agent are allowed (each connect changes the agent’s telephony password, so in practice
one browser per agent). Requires human calling and web calling enabled for your account. No CORS.
curl --request POST \
--url https://api.voice.mergenlab.ai/v1/web-sessions \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"agent": {
"id": "u_123",
"name": "Priya"
},
"ttl_sec": 3600
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({agent: {id: 'u_123', name: 'Priya'}, ttl_sec: 3600})
};
fetch('https://api.voice.mergenlab.ai/v1/web-sessions', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.voice.mergenlab.ai/v1/web-sessions"
payload = {
"agent": {
"id": "u_123",
"name": "Priya"
},
"ttl_sec": 3600
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"session_id": "wbs_6c1f0e2d3b4a4c5d9e8f7a6b5c4d3e2f",
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0eXAiOiJ3ZWIiLCJzaWQiOiJ3YnNfNmMxZjBlMmQzYjRhNGM1ZDllOGY3YTZiNWM0ZDNlMmYiLCJ0aWQiOiJ0ZW5fY3JlZGZpbiIsImFnZW50IjoidV8xMjMiLCJpYXQiOjE3OTE3OTkyMDAsImV4cCI6MTc5MTgwMjgwMH0._4pQfhoTeCf5dd2dhkdmImbxf0aXBCg_U4pbpwlwFXc",
"expires_at": "2026-10-12T11:00:00.000Z",
"agent": {
"id": "u_123",
"name": "Priya"
}
}Authorizations
Authorization: Bearer vg_live_<32 hex characters>. Keys are issued by Mergen admins and shown once.
Missing or invalid key: 401 unauthorized. Suspended account: 403 tenant_suspended.
Body
Response
The session and its token (the token is not shown again).
A web session for one agent. The token is returned only here.
wbs_ + 32 hex characters (revoke with DELETE /v1/web-sessions/{id}).
"wbs_6c1f0e2d3b4a4c5d9e8f7a6b5c4d3e2f"
The web session token (an HS256 JWT) for the agent's browser. Treat it as a secret.
Show child attributes
Show child attributes