Skip to main content
This flow only applies to Direct Mode (DrivingServiceMode.direct), where the client opens a Motion Server WebSocket from AvatarController.start(). The recommended RTC integrations use DrivingServiceMode.rtc; Backend Mode uses DrivingServiceMode.backend. None of those paths opens that client-side Motion Server WebSocket or needs a Spatius Session Token.

​
Before you start

Open Apps, select your app, then copy its App ID and generate an API Key under Developer → API Key. Session Token issuance requires a server-side component — implement an authentication endpoint on your own business server and keep the API Key there. The flow involves two distinct Spatius services:
  • Console API — issues Session Tokens. Your business server calls this with your API Key.
  • Motion Server — handles avatar runtime connections. The Direct Mode AvatarKit client connects here using the Session Token.

​
Connection flow

  1. The client sends an authentication request to your business server.
  2. The business server sends a request to the Spatius Console API to generate a Session Token, including expiration time in the request body and the API Key in the X-API-Key header.
  3. The Console API returns the Session Token to your business server.
  4. The business server returns the Session Token to the client.
  5. The client sets the token on AvatarSDK, then starts its AvatarController. The exact setter differs by platform.
  6. The controller opens the Motion Server WebSocket authenticated with the Session Token.

​
Token expiration

If you attempt to establish a new connection after the token’s configured expiration time, it will be rejected. Existing established connections are not affected.

​
Notes

  • Avoid leaking your API Key; ensure it is only used on the server.
  • Keep Session Tokens short-lived and issue a fresh token for each new connection.
For the endpoint shape and request fields, see the Session Token API.