GenerateSessionInfoV2

Creates a Cheggout session for an authenticated user. The resulting sessionId, paired with the user's virtualId, is what makes single sign-on work: the customer lands inside Cheggout without seeing a login screen.

Available

POST /api/GenerateSessionInfoV2

Environment	URL
Production	`https://bankapi.cheggout.com/api/GenerateSessionInfoV2`
UAT	`https://bankapi-uat.cheggout.com/api/GenerateSessionInfoV2`

Authentication — Signed envelope

This is the trust anchor for SSO

Cheggout accepts your signed assertion that this virtualId is an authenticated customer of yours. Call it only after your own authentication has succeeded, and derive virtualId from your session — never from client input.

Prerequisites

Agreed during onboarding:

Public key certificates exchanged in both directions.
Your server IP addresses whitelisted for session-ID verification.
A Virtual ID generation service available to Cheggout and to your application vendor, so the same virtualId can be resolved consistently.

Request

Standard signed envelope — CHANNELID, SIGN, BDATA.

BDATA payload

Field	Type	Required	Description
`bName`	string	Yes	Your channel name
`virtualId`	string	Yes	The authenticated user's pseudonymous identifier

The key is bName

This endpoint uses bName, matched case-sensitively — the same convention as getSecuredReferenceToken, and different from GetAuthToken.

Payload before encoding
{
  "bName": "YOURCHANNEL",
  "virtualId": "pub_8f14e45fceea167a"
}

Example

curl -X POST https://bankapi-uat.cheggout.com/api/GenerateSessionInfoV2 \
  -H "Content-Type: application/json" \
  -d '{
        "CHANNELID": "YOURCHANNEL",
        "SIGN": "REPLACE_WITH_YOUR_BASE64_SIGNATURE",
        "BDATA": "REPLACE_WITH_BASE64_PAYLOAD"
      }'

Response

Signed envelope — CHANNELID: "CHEGGOUT", SIGN, BDATA. Verify the signature before use.

Decoded BDATA

Field	Type	Description
`sessionId`	string	The session identifier

Decoded BDATA
{ "sessionId": "REPLACE_WITH_SESSION_ID" }

Pass both values to the launch

The sessionId is generated from the virtualId. The same virtualId and sessionId must be supplied together when launching the SDK or a hosted microsite. Mismatched values will not authenticate — on iOS the documented symptom is the SDK not progressing past its initial screen.

The SSO flow

Session lifetime

TBD Session lifetime is not published. Treat a session as valid for the user's active visit and mint a fresh one on each launch rather than caching across app launches — minting is a single backend call and avoids relying on undocumented expiry behaviour.

Session closing behaviour is documented on the SDK side: when the user presses back or home on the Cheggout home screen, the SDK session terminates and control returns to your app. What happens next depends on your app — either end the session and return the user to your login page, or keep it alive with Last Activity Time / Heartbeat and return them to your home screen. See Return handshake.

Errors

Response	Meaning	What to do
`{"STATUS":"FAILURE","ERRORSTRING":"Signature Mismatch!"}`	Signature could not be verified	Check you signed the Base64 `BDATA` string and that `CHANNELID` is correct
`{"STATUS":"FAILURE","ERRORSTRING":"Internal Error!"}`	Platform-side failure	Retry with backoff

Failure bodies carry no SIGN — check for this shape before verifying.

TBD No error catalogue distinguishes an unknown channel, an unwhitelisted IP or a malformed virtualId.

Domain options for a microsite

If you are launching a hosted experience rather than the native SDK, the microsite can be served from either:

A Cheggout subdomain — for example https://partnerXYZ.cheggout.com
Your own branded domain — for example https://partnerrewardshop.com

Agree the choice during onboarding. See Hosted experience.

Prerequisites​

Request​

BDATA payload​

Example​

Response​

Decoded BDATA​

The SSO flow​

Session lifetime​

Errors​

Domain options for a microsite​

Next​