Function create_session 

pub(crate) async fn create_session(
    __arg0: State<AppState>,
    peer: Peer,
    headers: HeaderMap,
    query: Result<Query<SessionQuery>, QueryRejection>,
) -> Response

POST /xrpc/bot.did.createSession?did=

A session as a hosted account, from a proof its credential records name: a JWT signed by one of its keys, or an OpenID Connect token one of its identities describes. How a pipeline run becomes its pipeline. An ID token is checked against the identities of the account did names alone, so it needs did; a key proof names its account in iss. Gated by the e-stop the way every session issuance is.

Reading the proof can fetch an issuer’s keys before any signature is checked, so each call spends AppState::provision_rate_limiter’s per-address budget first, the one createAccount spends.