> Fetch clean Markdown by appending `.md` to any page URL under https://signalwire.com/docs or requesting it with the HTTP header `Accept: text/markdown`. The root index at https://signalwire.com/docs/llms.txt lists the available documentation indexes.

# SessionManager

> Stateless HMAC-SHA256 token manager for SWAIG function call authentication and per-session metadata storage.

`SessionManager` provides stateless HMAC-SHA256 token generation and validation
for SWAIG function call authentication. Tokens encode a call ID, function name,
expiry, and nonce, signed with a shared secret. It also supports per-session
metadata storage with automatic cleanup.

```typescript {3}
import { SessionManager } from '@signalwire/sdk';

const sm = new SessionManager(900); // 15-minute token expiry
const token = sm.generateToken('get_weather', 'call-123');
const valid = sm.validateToken('call-123', 'get_weather', token);
```

## **Constructor**

**`tokenExpirySecs`** `number` — default: 900

Token validity duration in seconds.

---

**`secretKey`** `string`

HMAC signing secret. A random 32-byte key is generated if omitted.

---

## **Properties**

**`debugMode`** `boolean` — default: false

When `true`, [`debugToken`](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/debug-token)
decodes token internals for inspection. When `false`, `debugToken` returns
`{ error: "debug mode not enabled" }`. Set this to `true` at runtime only when
you need to inspect token contents.

---

## **Methods**

#### [createSession](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/create-session)

Return or generate a session identifier.

#### [generateToken](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/generate-token)

Generate a signed token binding a function to a call ID.

#### [createToolToken](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/create-tool-token)

Alias for generateToken.

#### [validateToken](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/validate-token)

Validate a token against expected call ID and function name.

#### [validateToolToken](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/validate-tool-token)

Alias for validateToken with reordered parameters.

#### [debugToken](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/debug-token)

Decode token components without validating the signature.

#### [getSessionMetadata](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/get-session-metadata)

Retrieve metadata for a session.

#### [setSessionMetadata](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/set-session-metadata)

Merge metadata into a session.

#### [cleanup](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/cleanup)

Remove expired session metadata entries.

#### [deleteSessionMetadata](/docs/server-sdks/reference/typescript/agents/configuration/session-manager/delete-session-metadata)

Delete all metadata for a session.

## **Example**

```typescript {3-4,7-8}
import { SessionManager } from '@signalwire/sdk';

const sm = new SessionManager();
const token = sm.generateToken('get_weather', 'call-abc123');

// Later, validate the token
const valid = sm.validateToken('call-abc123', 'get_weather', token);
console.log('Token valid:', valid); // true
```

> Stateless HMAC-SHA256 token manager for SWAIG function call authentication and per-session metadata storage.

## Docs

- [cleanup](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/cleanup.md): Remove expired session metadata entries.
- [createSession](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/create-session.md): Return the given call ID or generate a new random session identifier.
- [createToolToken](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/create-tool-token.md): Alias for generateToken.
- [debugToken](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/debug-token.md): Decode token components for inspection without validating the signature.
- [deleteSessionMetadata](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/delete-session-metadata.md): Delete all metadata for a session.
- [generateToken](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/generate-token.md): Generate a signed, base64url-encoded token binding a function name to a call ID.
- [getSessionMetadata](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/get-session-metadata.md): Retrieve metadata associated with a session.
- [setSessionMetadata](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/set-session-metadata.md): Merge metadata into a session.
- [validateToken](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/validate-token.md): Validate a token against the expected call ID and function name.
- [validateToolToken](https://signalwire.com/docs/server-sdks/reference/typescript/agents/configuration/session-manager/validate-tool-token.md): Alias for validateToken with reordered parameters.