Skip to main content

​
The Scute Session Object

Scute Session represents the authentication tokens returned after successful authentication. This object contains JWT tokens used to authenticate API requests.

​
Attributes

​
string
required
JWT access token for API authenticationExample: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
​
string
JWT refresh token for obtaining new access tokens (only included if app has refresh_payload enabled)Example: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
​
string
required
CSRF token for request validationExample: a1b2c3d4e5f6g7h8i9j0
​
integer
required
Unix timestamp when the access token expiresExample: 1705318200
​
integer
Unix timestamp when the refresh token expires (only included if refresh token is present)Example: 1737940200
​
string
required
ID of the authenticated user (not included for M2M sessions)Example: usr_1234567890
​
string
required
ID of the RSA key used to sign the JWT tokensExample: key_abc123
​
string
Client name for M2M (machine-to-machine) sessions onlyExample: api-service-prod

​
Example Scute Session Object

​
User Session (with refresh token)

​
User Session (without refresh token)

​
M2M (Machine-to-Machine) Session

​
JWT Token Payload

The access and refresh tokens contain the following claims:
​
string
User ID (only in user sessions, not in M2M sessions)
​
string
required
Application ID
​
string
required
Workspace ID
​
boolean
Flag indicating this is a machine-to-machine session (only in M2M tokens)
​
string
Credential ID (only in WebAuthn sessions)
​
integer
required
Token expiration time (Unix timestamp)
​
string
required
Unique token identifier for session management