Create a new session. For 'grantType', use 'password' to sign in with an email and password, 'refreshToken' to exchange a refresh token for a new session, or 'clientCredentials' for service account auth with a clientId and clientSecret.

A JSON request from the app's own origin (called through the app host's /_auth proxy; Sec-Fetch-Site: same-origin or absent) that mints a personal session also receives the refresh token as an httpOnly ldt_rt cookie (Path=/_auth, SameSite=Strict, Secure). Form-encoded and cross-site requests never receive the cookie. Browsers should rely on the cookie rather than the body's refreshToken, which is omitted for cookie-receiving requests once the migration completes.

For the 'refreshToken' grant, a refreshToken in the body is used when present; otherwise the ldt_rt cookie is. With neither, the request is rejected with 401. A token that was rotated within the last few seconds is treated as a retry and returns the same successor rather than revoking the session.