ChatGPT Session JSON Format

The raw ChatGPT session extracted from https://chatgpt.com/api/auth/session or via browser DevTools → Application → LocalStorage.

JSON Structure

{
  "WARNING_BANNER": "!!!!!!!!!!!!!!!!!!!! DO NOT SHARE ... !!!!!!!!!!!!!!!!!!!!",
  "user": {
    "id": "user-XXX",           // ChatGPT user ID (user-... format)
    "name": "Display Name",      // From Google/OAuth profile
    "email": "user@gmail.com",   // Login email
    "image": "https://lh3.google...",    // Avatar URL
    "picture": "https://lh3.google...",  // Same as image
    "idp": "google-oauth2",      // Identity provider (google-oauth2, auth0, etc.)
    "iat": 1783170779,           // Issued-at timestamp (Unix epoch)
    "mfa": false                 // Multi-factor auth enabled
  },
  "expires": "2026-10-02T13:13:07.423Z",  // ISO 8601 expiry
  "account": {
    "id": "UUID",                // Account UUID (different from user.id)
    "planType": "free",          // free | plus | pro | k12
    "structure": "personal",     // personal | workspace
    "isUsageBasedSeatEnabled": false,
    "isConversationClassifierEnabledForWorkspace": true,
    "isFedrampCompliantWorkspace": false,
    "isDelinquent": false,
    "residencyRegion": "no_constraint",
    "computeResidency": "no_constraint"
  },
  "accessToken": "[REDACTED-JWT]...",   // JWT (RS256) — for API calls
  "authProvider": "openai",                     // Always "openai"
  "sessionToken": "[REDACTED-JWT]...", // JWE (dir+A256GCM) — for web socket auth
  "rumViewTags": {
    "light_account": {"fetched": false}
  }
}

Token Types

Field	Algorithm	Format	Use
`accessToken`	RS256 (JWT)	`header.payload.signature`	REST API calls (`Authorization: Bearer <token>`)
`sessionToken`	dir + A256GCM (JWE)	`header.encryptedKey.iv.ciphertext.tag`	WebSocket auth, chat session refresh

Plan Types

planType	Models Available	Notes
`free`	gpt-3.5-turbo, limited gpt-4o	No O1/O3/GPT-5 access
`plus`	gpt-4o, o1, o3-mini	$20/mo
`pro`	+o1-pro, gpt-4.5o, gpt-5	$200/mo
`k12`	gpt-4o, o3-mini, gpt-5.5	Education workspace; O1 blocked by anti-abuse

IMAP Extraction Flow (alternative to browser)

When the user provides the session JSON directly (copied from browser DevTools), save it to disk and validate:

import json

with open('session.json') as f:
    data = json.load(f)

# Validate structure
assert 'accessToken' in data, "Missing accessToken"
assert 'user' in data, "Missing user"
assert data['user'].get('email'), "Missing email"

# The accessToken can be used directly with OpenAI API:
# Authorization: Bearer <accessToken>
# Or fed into chat2api-proxy's tokens.txt

Extraction Methods

Browser DevTools: Open chatgpt.com → F12 → Application → LocalStorage → copy ___session or visit https://chatgpt.com/api/auth/session
Hermes Bridge: Chrome extension → captures cookies/tokens from logged-in browser → saves to hermes_bridge.json
Direct user paste: User copies the JSON from DevTools and pastes it (as done 2026-07-04)

Account Inventory

Email	Name	Plan	Structure	Expires	Token exp (10-day JWT)
[REDACTED-NAME]@gmail.com	Ваня	free	personal	2026-10-02	—
oooo1111oooo2222a@gmail.com	Серёга	free	personal	2026-10-02	—
[REDACTED-NAME]@gmail.com	Никита	k12	workspace	2026-10-02	2026-07-14 (iat 07-04, ~10 day JWT)

All accounts: Google OAuth2, no_constraint residency. The K12 account ([REDACTED-NAME]) is a workspace-joined teacher account — planType: "k12", structure: "workspace", workspaceType: "production", org ID org-SITeTvGbrEDafVa9EHkSEn1j.

3.8 KiB Raw Blame History