`sessionId`: at the time i was thinking about how `generateToken` decode's the sessionId to make sure it belongs to the current apiKey. in truth this is probably not necessary since as you said the server would just return a 404.

`name`: is there a maximum length defined?