> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spoofsense.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Peek at a session (client token)

> Called by the SDK at mount, authenticated with the `sst_` client token. Returns the session's nonce (required in the submit payload) and status, so an expired or used session fails fast before the camera opens.



## OpenAPI

````yaml /api-reference/openapi.json get /v1/verification_sessions/session_info
openapi: 3.1.0
info:
  title: SpoofSense API
  version: '1.0'
  description: >-
    Face liveness and deepfake detection. All errors use the envelope `{"error":
    {"code", "message"}}`. Input errors (4xx) are never charged.
servers:
  - url: https://api.spoofsense.ai
security:
  - secretKey: []
tags:
  - name: Detection
    description: >-
      Stateless checks on an image you already have. Authenticate with your
      secret key.
  - name: Verification sessions
    description: >-
      The secure capture flow used by the SDKs and hosted page. Server-side
      calls use the secret key; client-side calls use the session's sst_ token.
  - name: Service
paths:
  /v1/verification_sessions/session_info:
    get:
      tags:
        - Verification sessions
      summary: Peek at a session (client token)
      description: >-
        Called by the SDK at mount, authenticated with the `sst_` client token.
        Returns the session's nonce (required in the submit payload) and status,
        so an expired or used session fails fast before the camera opens.
      operationId: getSessionInfo
      responses:
        '200':
          description: Session metadata
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  status:
                    type: string
                    enum:
                      - created
                      - complete
                      - failed
                      - expired
                  nonce:
                    type: string
                    description: Echo this in client_payload.nonce on submit.
                  products:
                    type: array
                    items:
                      type: string
                  expires_at:
                    type: string
                    format: date-time
        '401':
          $ref: '#/components/responses/InvalidSessionToken'
        '410':
          $ref: '#/components/responses/SessionExpired'
      security:
        - sessionToken: []
components:
  responses:
    InvalidSessionToken:
      description: INVALID_SESSION_TOKEN — sst_ token missing, wrong, or no longer valid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: INVALID_SESSION_TOKEN
              message: Invalid or expired session token
    SessionExpired:
      description: SESSION_EXPIRED — TTL elapsed; create a new session
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: SESSION_EXPIRED
              message: Verification session expired
  schemas:
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
  securitySchemes:
    secretKey:
      type: http
      scheme: bearer
      description: >-
        Your secret key (sk_live_…), server-side only. Also accepted as an
        `x-api-key` header.
    sessionToken:
      type: http
      scheme: bearer
      description: >-
        A verification session's single-use client token (sst_…), minted by POST
        /v1/verification_sessions.

````