Map sessions & styles

Called by the SDK before the map is created. Creates a server-generated session_id (ends after 30 minutes without a token refresh or style request) and a 1-hour tile token whose scp is the intersection of the key's effective scopes (key ∩ plan) and the tile products (basemap, overlay, traffic). A free key's token never carries traffic. Counted as one map session; style requests and token refreshes in the same session are not counted again.

The SDK refreshes the token at refresh_after (20 minutes after issue) while the map is in use, which also keeps the session alive; a map left alone for 30 minutes ends its session and the next refresh answers 410 session_expired. The token carries the session id (sid). A replay with the same Idempotency-Key from the same key returns the same session (not counted again) with a freshly minted token. Key restrictions (Origin / package / egress IP) apply.

The SDK calls this at refresh_after (and before expires_at). Keeps the session alive. Returns 410 session_expired after 30 minutes of inactivity (or for an unknown session id); the SDK then starts a new session. A session belongs to the API key that created it: any other key gets 404. Tokens are signed with the current kid; old tokens stay valid until their own exp unless the key is revoked or its scopes / restrictions change (the tile edge then answers 401 key_revoked / 401 token_expired within 1 minute). A refresh changes nothing but the session's last activity, so a replay with the same Idempotency-Key simply mints another token.

P2's generated style. Language and theme are root-level state (lang, theme) switched on the client without reloading, so they are not parameters here. Tile URLs inside the style carry no token: the Web SDK adds t= in transformRequest, native SDKs add X-Atasu-Token only for exact atasumaps.com hosts. The key may be passed as ?key= because MapLibre fetches the style itself (web keys are public and origin-restricted).

Served from the built P2 styles (standard; standard-3d and navigation answer 404 until they are built). session must be a live session of the same key (410 session_expired otherwise); the request counts as activity in that session.