SessionManager | SignalWire

SessionManager provides stateless HMAC-SHA256 token generation and validation for SWAIG function call authentication. Tokens encode a call ID, function name, expiry, and nonce, signed with a shared secret. It also supports per-session metadata storage with automatic cleanup.

import { SessionManager } from '@signalwire/sdk';
const sm = new SessionManager(900); // 15-minute token expiry
const token = sm.generateToken('get_weather', 'call-123');
const valid = sm.validateToken('call-123', 'get_weather', token);

Constructor

tokenExpirySecs

numberDefaults to 900

Token validity duration in seconds.

secretKey

string

HMAC signing secret. A random 32-byte key is generated if omitted.

Properties

debugMode

booleanDefaults to false

When true, debugToken decodes token internals for inspection. When false, debugToken returns { error: "debug mode not enabled" }. Set this to true at runtime only when you need to inspect token contents.

Methods

createSession

Return or generate a session identifier.

generateToken

Generate a signed token binding a function to a call ID.

createToolToken

Alias for generateToken.

validateToken

Validate a token against expected call ID and function name.

validateToolToken

Alias for validateToken with reordered parameters.

debugToken

Decode token components without validating the signature.

getSessionMetadata

Retrieve metadata for a session.

setSessionMetadata

Merge metadata into a session.

cleanup

Remove expired session metadata entries.

deleteSessionMetadata

Delete all metadata for a session.

Example

import { SessionManager } from '@signalwire/sdk';
const sm = new SessionManager();
const token = sm.generateToken('get_weather', 'call-abc123');
// Later, validate the token
const valid = sm.validateToken('call-abc123', 'get_weather', token);
console.log('Token valid:', valid); // true