Skip to main content

Endpoint Details

Overview

The Active Sessions API provides a server-to-server endpoint for discovering active WordPress user sessions. Unlike traditional cookie-based approaches, this endpoint directly queries the WordPress database for session data, making it more reliable for cross-domain authentication.
This endpoint requires a shared secret for authentication. Never expose this secret in client-side code.

Authentication

All requests to this endpoint must include the X-ASAP-Sync-Secret header with the shared secret value configured in your WordPress environment. This secret is defined with the BETTER_AUTH_SECRET constant in your WordPress configuration.

Request Parameters

string
required
An identifier for the source of the request (e.g., “svelte-kit-server”)
number
required
The current timestamp in milliseconds
object
Optional server information for debugging purposes

Response Format

boolean
required
Indicates whether the operation was successful
array
Array of user objects with active WordPress sessions
number
Server timestamp when the response was generated
string
Error message if success is false

Error Codes

Additional Resources