API require explicit initiation and injection of session key parameter

Should be private (or protected) I think.