# create-session

> Create a short-lived Customer Portal session

Create an exchange code valid for 15 minutes and exchangeable exactly once for
a 24-hour portal access token. Redirect the end user to the returned URL.

## Usage
```bash
unkey api portal create-session [flags]
```
## Flags
<ParamField body="--portal" type="string" required>Portal configuration ID or slug.</ParamField>
<ParamField body="--external-id" type="string" required>The end user's identifier in your system.</ParamField>
<ParamField body="--scopes" type="string[]" required>Capabilities: `keys:read`, `keys:create`, `keys:reroll`, and `analytics:read`.</ParamField>
<ParamField body="--preview" type="bool" default="false">Create a preview session for testing.</ParamField>
<ParamField body="--return-url" type="string">Absolute URL to return the end user to when they leave the portal.</ParamField>
## Global Flags
| Flag | Type | Description |
|------|------|-------------|
| `--root-key` | string | Override root key (`$UNKEY_ROOT_KEY`) |
| `--api-url` | string | Override API base URL (default: `https://api.unkey.com`) |
| `--config` | string | Path to config file (default: `~/.unkey/config.toml`) |
| `--output` | string | Output format, use `json` for raw JSON |
| `--body` | string | Send this JSON string as the request body. You cannot combine it with request-building flags. |
## Examples
```bash
unkey api portal create-session --portal=my-portal --external-id=user_123 \
  --scopes=keys:read,keys:reroll \
  --return-url=https://app.example.com/settings/api-keys
```