> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tilion.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Saved logins

Save a site's cookies to load them into later sessions on your account. Cookie values are encrypted at rest and are not returned by the API. `GET /v1/auth` lists connected domains and update times. Saved logins are scoped to the registrable domain, such as `linkedin.com`.

## POST /v1/session/\{session\_id}/save-auth

Save the session's cookies for one site. The session's current page must be on that site.

Request: `domain` (for example `httpbin.org`) or `url` (a URL on the site); one of them is required.

```bash theme={"dark"}
curl -X POST https://back.tilion.dev/v1/session/sess_3d245e56b86d4bc8ae32095b644117d4/save-auth \
  -H "Authorization: Bearer ph_live_..." -H "Content-Type: application/json" \
  -d '{"domain": "httpbin.org"}'
```

Response (200):

```json theme={"dark"}
{"ok": true, "domain": "httpbin.org", "cookies_saved": 1, "entry_id": "ea8e02bf7c7e4677b3f65445e7db133e"}
```

Errors: 400 `domain (or url) is required`; 400 `auth domain does not match current page` when the session is on another site; 400 `no scoped auth cookies to save` when the page set no cookies for that domain; 502 `Data Plane auth save failed`.

## GET /v1/auth

The sites your account has saved logins for.

```json theme={"dark"}
{"connected": [{"domain": "httpbin.org", "updated_at": "2026-10-19T14:39:02.324765+00:00"}]}
```

With nothing saved: `{"connected": []}`.

## POST /v1/auth/import

Bring your own cookies: paste a session cookie from a browser where you are already logged in, and your sessions start authenticated on that site.

Request:

| Field | Type | Meaning |
| - | - | - |
| `domain` | string, required | The site. |
| `cookies` | list of up to 100 `{name, value, domain?, path?, expires?, httpOnly?, secure?, sameSite?}` | Full cookie objects. `domain` defaults to `.` plus the registrable domain, `path` to `/`. |
| `token` | string | Shorthand for one session cookie instead of `cookies`. |
| `cookie_name` | string | Name for `token` (default `li_at`). |

```bash theme={"dark"}
curl -X POST https://back.tilion.dev/v1/auth/import \
  -H "Authorization: Bearer ph_live_..." -H "Content-Type: application/json" \
  -d '{"domain": "example.net", "cookies": [{"name": "session", "value": "s3cret", "domain": ".example.net", "path": "/", "httpOnly": true, "secure": true}]}'
```

Response (200): `{"ok": true, "domain": "example.net", "cookies_saved": 1}`. The shorthand `{"domain": "example.org", "token": "abc123", "cookie_name": "sid"}` answers `{"ok": true, "domain": "example.org", "cookies_saved": 1}`.

Errors: 400 `domain is required`; 400 `provide cookies:[...] or token:'<value>'`; 400 `incomplete_cookie_set` (`have`, `need`) for a LinkedIn import with `li_at` but no `JSESSIONID`; 400 `too many cookies (max 100)`; 400 `no usable cookies in the request`. A 200 with `ok: false` and `cookies_saved: 0` means none of the cookies belonged to that domain.

```json theme={"dark"}
{"detail": {"error": "incomplete_cookie_set", "message": "LinkedIn needs BOTH li_at and JSESSIONID (the CSRF token must match JSESSIONID). ...", "have": ["li_at"], "need": ["li_at", "JSESSIONID"]}}
```

## DELETE /v1/auth/\{domain}

Forget a saved login everywhere, including any copy that automatic unblocking could have reused.

Response (200): `{"ok": true, "domain": "httpbin.org", "data_plane_grants_retired": 1}`. The last field, present only when it is non-zero, counts stored grants that were retired as well. A second delete answers 404 `no saved login for httpbin.org`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.