# Create a client secret

A single-use credential that opens a Nur session you already configured, for a browser or a game client.

`POST https://api.eesi.ai/v1/realtime/client_secrets`

A one-use credential for a session your server configured.

A browser or a game build gets the returned ``value`` and opens
``/v1/realtime?token=<value>``. The session it opens starts with the
instructions, voice, tools and live state given here, and the client
cannot change what ``eesi_lock`` names (by default the instructions and
the tools): a modified client cannot rewrite who it is talking to. The
value is spent by the first socket that presents it.

Request body: application/json.

- `session` (object, required): A session.update body: instructions, audio, tools, ...
- `expires_after` (ClientSecretExpiry)
- `eesi_context` (object): Live-state blocks by key, with the limits of eesi.context.update.
- `eesi_control` (ClientSecretControl): Open a server control channel with the session: your server joins at /v1/realtime/control/{id}, sees its events and acts in it.
- `eesi_lock` (array of "instructions" | "tools" | "voice" | "turn_detection" | "context" | "conversation" or string): What the client may not change: instructions, tools, voice, turn_detection, context, conversation, or all. Defaults to instructions and tools.
- `eesi_limits` (ClientSecretLimits): A maximum call length and a silence hang-up, beyond the client.
- `eesi_webhook` (ClientSecretWebhook): Post each reply and the session's end to your server, signed.
- `eesi_metadata` (object): Your own tags (at most 16), echoed in every webhook.
- `eesi_data` (ClientSecretData): Keep the session out of training, or out of storage.

Responses: 200, 400, 404.

Schemas: https://docs.eesi.ai/api-reference/public.json