# Session & token

Creating a Cashier session returns a `sessionId` and a `token`. For the concept and the comparison with the API access token, see [Sessions & tokens](/guides/concepts/sessions-and-tokens).

## The Cashier token

- **Mandatory.** Open with `open({ sessionId, token })`. Opening without the token is rejected.
- **A JWT, treated as opaque.** Don't decode, validate or inspect it — Omno verifies it. Pass it straight through.
- **Bound to its session.** It authorizes only this one Cashier session and cannot open or act on any other.
- **15-minute lifetime.** The token expires **with** the session — 15 minutes from creation. It has no separate expiry.


## Reuse

You can reuse the token for the **same** session until the session expires — for a `reload()`, a browser refresh, or switching between deposit and withdrawal. `reload()` reuses the token from the original `open()`, so you don't pass it again.

## Create on click, not on page load

Create the session right before you open the Cashier — for example when the player clicks **Deposit** — not at page load. A session created too early may expire before the customer acts.

## Expiry

When the session expires, the Cashier shows a **session-expired screen**. To continue, create a **new** session on your backend and call `open()` again with the new `sessionId` and `token`. There is no refresh for an expired session.

## Storage and logging

- Create sessions **server-side** only.
- **Never log or store** the token. Pass it from your backend to the frontend and into the SDK, and no further.


## Build it →

- [Integration steps](/cashier/integrate) · [Open without the SDK](/cashier/hosted-url) · [Web SDK → Errors](/cashier/sdk/errors)