> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tilta.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an onboarding session

> Generate a short-lived onboarding session for a buyer. Returns a JWT and hosted URL to launch Tilta white-labeled credit application flow for the buyer.

Before a buyer can use Tilta payment terms, they must complete the onboarding flow – a white-labeled, Tilta-hosted experience where they confirm their business details and consent to the credit application. This endpoint creates a short-lived session that gives the buyer secure, authenticated access to that flow.

## Integration options

<CardGroup cols={2}>
  <Card title="Redirect integration" icon="square-arrow-out-up-right">
    Redirect the buyer's browser to the `url` returned in the response. Tilta hosts the full onboarding experience and
    redirects back to your `success_url` or `error_url` when the buyer finishes. This is the quickest way to get started with
    zero frontend code changes.
  </Card>

  <Card title="Embedded Web Element" icon="square-mouse-pointer">
    Use the `token` to initialize the Tilta JS SDK and embed the onboarding UI directly within your platform's checkout or
    account page. Provides a seamless white-labeled experience without leaving your site.
  </Card>
</CardGroup>

<Warning>
  Onboarding sessions are short-lived. If the buyer does not start the onboarding flow within the session's validity window, you
  must create a new session. Do not cache or reuse session tokens across requests.
</Warning>

<Note>
  Onboarding is only relevant for buyers who do not yet have a credit facility. Call [Retrieve
  facility](/api-reference/facilities/retrieve-facility) first – if it returns a facility, the buyer has already been through
  onboarding.
</Note>


## OpenAPI

````yaml POST /v1/buyers/{external_id}/sessions/onboarding
openapi: 3.0.0
info:
  version: 0.0.1
  title: Tilta API
  description: Tilta API documentation
servers:
  - url: https://api.tilta.io
    description: Tilta Production API
  - url: https://api.tilta-sandbox.io
    description: Tilta Sandbox API
security: []
paths:
  /v1/buyers/{external_id}/sessions/onboarding:
    post:
      tags:
        - Buyers
      summary: Create a buyer onboarding session
      description: >-
        Creates an onboarding session for a buyer.

        Returns a short-lived JWT token and a pre-built hosted onboarding URL.
        Use the token to initialise the Tilta JS SDK web element, or redirect
        the buyer to the URL to use the hosted onboarding UI.
      parameters:
        - schema:
            type: string
            maxLength: 100
            pattern: ^[a-zA-Z0-9-_]+$
            description: Unique identifier of a buyer.
          required: true
          name: external_id
          in: path
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                success_url:
                  type: string
                  format: uri
                error_url:
                  type: string
                  format: uri
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  token:
                    type: string
                  url:
                    type: string
                required:
                  - token
                  - url
                description: >-
                  JWT token and hosted onboarding URL to authenticate a buyer in
                  the self onboarding flow. The token is valid for 2h.
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/badRequestSchema'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/unauthorizedRequestSchema'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/buyerNotFoundSchema'
      security:
        - bearerAuth: []
components:
  schemas:
    badRequestSchema:
      type: object
      properties:
        code:
          type: string
          description: Error code
          example: BAD_REQUEST
        error:
          type: string
          description: Error message for debugging purposes
          example: Request validation failed. 1 issue found.
        issues:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                description: Issue code
                example: INVALID_TYPE
              path:
                type: string
                description: Issue path starting with body, params, querystring, or headers
                example: body.registered_at
              message:
                type: string
                description: Issue message for debugging purposes
                example: Invalid type
            required:
              - code
              - path
              - message
          description: List of issues
          example:
            - code: INVALID_TYPE
              path: body.registered_at
              message: Invalid type
      required:
        - code
        - error
        - issues
      description: Bad Request, see error message for details.
      example:
        code: BAD_REQUEST
        error: Request validation failed. 1 issue found.
        issues:
          - code: INVALID_TYPE
            path: body.registered_at
            message: Invalid type
    unauthorizedRequestSchema:
      type: object
      properties:
        error:
          type: string
          description: Error details.
          example: Unauthorized
        code:
          type: string
          description: Error code.
          example: UNAUTHORIZED
      required:
        - error
        - code
      description: Unauthorized Request.
      example:
        error: Unauthorized
        code: UNAUTHORIZED
    buyerNotFoundSchema:
      type: object
      properties:
        error:
          type: string
          description: Error details.
          example: No Entity found
        code:
          type: string
          description: Error code.
          example: NOT_FOUND
      required:
        - error
        - code
      description: Buyer not found
      example:
        error: No Entity found
        code: NOT_FOUND
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Your Tilta API key, sent as `Bearer <key>`.

````