Login tickets API

Login tickets let a trusted server open any UI page in an iframe, tab or window without exposing a permanent API key to the browser.

1. Create a ticket (integration server)

POST /api/v2/login-tickets
X-API-Key: <api-key>

No request body is required.

Response: 201 Created

{
  "loginTicket": "<opaque-single-use-ticket>",
  "expiresIn": 60,
  "expiresAt": "<expiration timestamp, e.g. 2026-10-15T17:00:00Z>"
}

2. Use the ticket

Append #loginTicket=<ticket> to the desired UI URL and open the URL in the browser or iframe. UI Next automatically redeems the ticket, establishes the browser session, and reloads that same page without the ticket. The session uses the user associated with the API key.

Tickets expire after 60 seconds and can be redeemed once.

Note

Use the publicOrigin parameter in the system configuration file for resolving problem with non-matching origin. For example, in case of exchanges behind a reverse proxy when the internal address differs from the public address.