> ## Documentation Index > Fetch the complete documentation index at: https://docs.meld.io/llms.txt > Use this file to discover all available pages before exploring further. # Create a requirements session > Mints a requirements session for one customer and up to five providers. Call it from your backend with an API key that can create orders, and pass the 201 response unchanged to `Meld.ensureReady` in your app or page. The SDK then runs the customer's requirements for those providers with the session token, and your API key never leaves your backend. The token is a bearer for this customer, these providers and this order only, and it expires after 30 minutes (`expiresAt`): never log or store it. Requirements sessions are unversioned, so every `Meld-Version` answers the same, and each provider's checklist is the one `GET /crypto/onramp/{serviceProvider}/requirements` returns at Meld-Version 2026-11-01. They are enabled per account: until yours is, the call answers 403 `REQUIREMENTS_SESSIONS_NOT_ENABLED`. Responses carry `Cache-Control: no-store`. ## OpenAPI ````yaml /openapi/crypto-20260203.json post /crypto/onramp/requirements-sessions openapi: 3.1.0 info: title: CRYPTO termsOfService: urn:tos license: name: Apache 2.0 url: https://springdoc.org version: '2026-02-03' description: '' servers: - url: https://api-sb.meld.io description: Meld API sandbox - url: https://api.meld.io description: Meld API production security: [] tags: - name: Retail Ramp description: '' - name: Headless description: '' - name: Payment description: '' - name: Session description: '' paths: /crypto/onramp/requirements-sessions: post: tags: - Headless summary: Create a requirements session description: >- Mints a requirements session for one customer and up to five providers. Call it from your backend with an API key that can create orders, and pass the 201 response unchanged to `Meld.ensureReady` in your app or page. The SDK then runs the customer's requirements for those providers with the session token, and your API key never leaves your backend. The token is a bearer for this customer, these providers and this order only, and it expires after 30 minutes (`expiresAt`): never log or store it. Requirements sessions are unversioned, so every `Meld-Version` answers the same, and each provider's checklist is the one `GET /crypto/onramp/{serviceProvider}/requirements` returns at Meld-Version 2026-11-01. They are enabled per account: until yours is, the call answers 403 `REQUIREMENTS_SESSIONS_NOT_ENABLED`. Responses carry `Cache-Control: no-store`. operationId: /crypto-onramp-requirements-sessions-create parameters: - name: Meld-Version in: header description: Dated API version to use for this request, e.g. `2026-02-03`. required: false schema: type: string example: '2026-02-03' requestBody: content: application/json: schema: $ref: '#/components/schemas/RequirementsSessionRequest' example: customerId: W9kL817BBS7bNEwxAZaX4z serviceProviders: - BANXA - UPHOLD order: paymentMethodType: CREDIT_DEBIT_CARD sourceCurrencyCode: USD sourceAmount: 250 destinationCurrencyCode: USDC destinationNetworkCode: BASE countryCode: US readyWhen: ALL required: true responses: '201': description: The session. Pass it to the SDK unchanged content: '*/*': schema: $ref: '#/components/schemas/RequirementsSessionResponse' example: id: Ny9YeB5gTh8WaQc3DrUf7k customerId: W9kL817BBS7bNEwxAZaX4z serviceProviders: - BANXA - UPHOLD readyWhen: ALL expiresAt: '2026-11-04T15:28:30Z' token: requirementsActions: version: 1 endpoint: >- /crypto/onramp/requirements-sessions/Ny9YeB5gTh8WaQc3DrUf7k/actions bearerTokenPointer: /token operations: - operation: READ idempotencyKeyRequired: false - operation: RUN_STEP idempotencyKeyRequired: true '400': description: >- `REQUIREMENTS_SESSION_INVALID`: no providers or more than five, a provider named twice or unknown, an `order` missing a required field, or a `readyWhen` other than `ALL` or `ANY` content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Invalid credentials content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: >- The API key can't create orders; `REQUIREMENTS_SESSIONS_NOT_ENABLED`: requirements sessions aren't enabled for your account in this environment; or `SERVICE_PROVIDER_NOT_ENABLED`: a provider isn't enabled for headless orders on your account content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: >- `CUSTOMER_NOT_FOUND`: your account has no customer with this `customerId` content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: >- Server Error. This applies to all 5xx errors, including but not limited to 500, 501, 502, 503, and 504 errors. You should treat all of these errors the same. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - ApiKeyAuth: [] components: schemas: RequirementsSessionRequest: type: object description: Who the session is for, and what for properties: customerId: type: string description: The Meld customer the session is for example: W9kL817BBS7bNEwxAZaX4z order: description: >- The order you mean to create, whole or absent. With it, each provider that checks the order itself answers for this order, as the requirements do with the order parameters. Without it, such a provider never answers READY allOf: - $ref: '#/components/schemas/RequirementsSessionOrder' readyWhen: type: string description: >- ALL, the default: the session is READY when every provider is. ANY: when one is enum: - ALL - ANY serviceProviders: type: array description: >- The providers you might create the order with: 1 to 5, each once. Steps they share, such as Unified KYC or an email, run once for all of them items: type: string example: BANXA maxItems: 5 minItems: 1 uniqueItems: true required: - customerId - serviceProviders RequirementsSessionResponse: type: object description: >- The session. Pass it to `Meld.ensureReady` unchanged, and never log it: it carries the token properties: customerId: type: string expiresAt: type: string format: date-time description: >- When the token expires, 30 minutes after the session was created (ISO-8601 UTC) example: '2026-11-04T15:28:30Z' id: type: string description: The session id, 1 to 64 base58 characters readyWhen: type: string enum: - ALL - ANY requirementsActions: $ref: '#/components/schemas/RequirementsActions' serviceProviders: type: array items: type: string token: type: string description: The session bearer. Never log or store it required: - customerId - expiresAt - id - readyWhen - requirementsActions - serviceProviders - token ErrorResponse: type: object properties: code: type: string description: Stable identifier for the failure. errors: type: array items: type: string description: What was rejected, one entry per field or rule. message: type: string description: A description of what went wrong. requestId: type: string description: Quote this when asking Meld about a specific failure. serviceProviderDetails: type: object properties: code: type: string description: The provider's own error code, when it sent one. message: type: string description: The provider's own message. example: code: '5034' message: >- Digital currency and blockchain combination is restricted for customer's country description: >- The provider's own error detail, when the failure came from a service provider. Usually `code` and `message`; a few providers pass their own body through, so other keys can appear. additionalProperties: {} timestamp: type: string format: date-time description: >- When the failure occurred. ISO 8601, UTC (`YYYY-MM-DDThh:mm:ss.sss+00:00`). example: '2026-08-14T09:41:22.482+00:00' RequirementsSessionOrder: type: object description: The order intent, as the requirements take it in their query parameters properties: countryCode: type: string description: Where the customer is, ISO 3166-1 alpha-2 example: US destinationCurrencyCode: type: string description: Token the customer is buying, as Meld names it example: USDC destinationNetworkCode: type: string description: Chain, as Meld names it. Required for Stripe, recommended otherwise example: BASE paymentMethodType: type: string description: How the customer will pay example: CREDIT_DEBIT_CARD sourceAmount: type: number description: What the customer pays. Greater than zero exclusiveMinimum: 0 example: 250 sourceCurrencyCode: type: string description: Fiat the customer pays in, ISO 4217 example: USD subdivision: type: string description: State or province, ISO 3166-2 example: US-CA required: - countryCode - destinationCurrencyCode - paymentMethodType - sourceAmount - sourceCurrencyCode RequirementsActions: type: object description: >- Where the SDK sends the session's actions, and with what. Read by the SDK properties: bearerTokenPointer: type: string description: JSON pointer to the bearer token in the session example: /token endpoint: type: string description: >- The actions path, on the API host of the environment the session was created in example: /crypto/onramp/requirements-sessions/Ny9YeB5gTh8WaQc3DrUf7k/actions operations: type: array description: READ, without an idempotency key, and RUN_STEP, with one items: $ref: '#/components/schemas/RequirementsActionOperation' version: type: integer format: int32 example: 1 RequirementsActionOperation: type: object properties: idempotencyKeyRequired: type: boolean operation: type: string enum: - READ - RUN_STEP securitySchemes: ApiKeyAuth: type: apiKey in: header name: Authorization x-default: BASIC ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.