{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-guides/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Sessions & tokens","siteUrl":"https://docs.omno.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"sessions--tokens","__idx":0},"children":["Sessions & tokens"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Omno uses two different tokens. They have different purposes, lifetimes and scopes — keep them separate."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"the-two-tokens","__idx":1},"children":["The two tokens"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":""},"children":[]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"API access token"},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API access token"]}]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cashier session token"},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cashier session token"]}]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Purpose"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authenticate server-to-server API calls"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authorize opening one Cashier session"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Issuer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Token endpoint (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["sso.omno.com"]},")"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Returned by ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /v3/public/cashier/session"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Format"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OAuth 2.0 bearer (JWT)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["JWT"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Lifetime"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["~300 seconds (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expires_in"]},")"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["15 minutes, from session creation"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Where it lives"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your backend only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Created on your backend, passed to your frontend to open the Cashier"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Scope"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v3/public/..."]}," calls your credentials allow"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Only"]}," its own Cashier session — it cannot open or act on any other"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"the-cashier-token","__idx":2},"children":["The Cashier token"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["It is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["mandatory"]},": open the Cashier with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["open({ sessionId, token })"]},". Opening without the token is rejected."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["It is a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["JWT, but treat it as opaque"]}," — don't decode, validate or inspect it. Omno verifies it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["It is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["bound to its session"]}," and expires ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["with"]}," the session (15 minutes). It has no separate expiry."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You may reuse it for the same session until the session expires — for a reload, a refresh, or switching between deposit and withdrawal."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"session-lifetime","__idx":3},"children":["Session lifetime"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"stateDiagram-v2\n [*] --> Created: create session (token issued)\n Created --> Opened: open({ sessionId, token })\n Opened --> InProgress: customer pays\n Created --> Expired: 15 min\n Opened --> Expired: 15 min\n InProgress --> Expired: 15 min\n Expired --> NewSession: create a new session\n NewSession --> [*]\n","diagramHtml":"

create session (token issued)

open({ sessionId, token })

customer pays

15 min

15 min

15 min

create a new session

Created

Opened

InProgress

Expired

NewSession

","diagramHtmlDark":"

create session (token issued)

open({ sessionId, token })

customer pays

15 min

15 min

15 min

create a new session

Created

Opened

InProgress

Expired

NewSession

"},"children":["stateDiagram-v2\n [*] --> Created: create session (token issued)\n Created --> Opened: open({ sessionId, token })\n Opened --> InProgress: customer pays\n Created --> Expired: 15 min\n Opened --> Expired: 15 min\n InProgress --> Expired: 15 min\n Expired --> NewSession: create a new session\n NewSession --> [*]\n"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A session (and its token) is valid for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["15 minutes from creation"]},". When it expires, the Cashier shows a session-expired screen; create a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["new"]}," session and call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["open()"]}," again."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"rules","__idx":4},"children":["Rules"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create the session right before you open the Cashier"]}," — for example when the player clicks ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Deposit"]}," — not at page load. This avoids customers hitting expiry mid-flow."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create it server-side."]}," Never create sessions from the browser."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Never log or store the token."]}," Pass it straight through from your backend to the frontend and into the SDK."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["On expiry, create a new session"]}," — there is no refresh for an expired session."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"build-it-","__idx":5},"children":["Build it →"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/cashier/session-and-token"},"children":["Cashier → Session & token"]}," · ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/cashier/integrate"},"children":["Integration steps"]}]}]}]},"headings":[{"value":"Sessions & tokens","id":"sessions--tokens","depth":1},{"value":"The two tokens","id":"the-two-tokens","depth":2},{"value":"The Cashier token","id":"the-cashier-token","depth":2},{"value":"Session lifetime","id":"session-lifetime","depth":2},{"value":"Rules","id":"rules","depth":2},{"value":"Build it →","id":"build-it-","depth":2}],"frontmatter":{"title":"Sessions & tokens","description":"The two Omno tokens — the server-side API access token and the per-session Cashier token (a 15-minute JWT) — what each is for, and the rules for using them.","seo":{"title":"Sessions & tokens"}},"lastModified":"2026-11-06T11:46:00.426Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/concepts/sessions-and-tokens","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}