More controls for application sessions

Session lifetime and concurrency used to be harder to see and change from environment settings. Operators needed the management API fields and a console path that actually saved them. Environment settings now expose those controls, with coverage for the save path.

This is the longer note behind the March 10 changelog entry.

How it works

User-session settings persist on the environment JWT config (additionalFields.userSettings) and merge into envSessionConfig:

• sessionTimeoutMinutes — idle/session timeout; default 60, minimum 5
• allowConcurrentSessions — default true
• emailVerificationRequired — default true
• enforceMfaForAllUsers — default false

The same payload also carries auth-method flags (email, password, magic link, passkeys, MFA), registration flags, and theme metadata used by hosted pages.

The management API mutation is saveEnvironmentSessionConfig. The public environment-settings API proxies it:

• GET /v1/tenants/{tenantId}/environments/{environmentId}/session-config
• PUT the same path — partial update; only provided fields change

The users console and session-management views read and write these fields. End-to-end tests cover the saved environment settings path.

tokenLifetime, allowedClockSkew, subjectFormat, and issuer remain on the same session-config document.

Set it up

In the console, open the environment Users settings (or Security > Session management):

1. Set session timeout to at least 5 minutes.
2. Decide whether concurrent sessions are allowed.
3. Save, then reload the page and confirm the values stuck.

API clients send the same fields on PUT …/session-config.

Trust boundaries

These flags configure application sessions in that environment. They do not replace token revocation, MFA, or Lidar. A longer timeout increases the window a stolen session stays valid.

allowConcurrentSessions is a policy flag, not a guarantee that every device is enumerated in the UI.

Try it

Change sessionTimeoutMinutes, save, and sign in again on the hosted Account Portal. Console notes are in Sessions. The original release note is in the changelog.