> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scute.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Scute Session

## The Scute Session Object

Scute Session represents the authentication tokens returned after successful authentication. This object contains JWT tokens used to authenticate API requests.

### Attributes

<ResponseField name="access" type="string" required>
  JWT access token for API authentication

  **Example:** `eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...`
</ResponseField>

<ResponseField name="refresh" type="string">
  JWT refresh token for obtaining new access tokens (only included if app has refresh\_payload enabled)

  **Example:** `eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...`
</ResponseField>

<ResponseField name="csrf" type="string" required>
  CSRF token for request validation

  **Example:** `a1b2c3d4e5f6g7h8i9j0`
</ResponseField>

<ResponseField name="access_expires_at" type="integer" required>
  Unix timestamp when the access token expires

  **Example:** `1705318200`
</ResponseField>

<ResponseField name="refresh_expires_at" type="integer">
  Unix timestamp when the refresh token expires (only included if refresh token is present)

  **Example:** `1737940200`
</ResponseField>

<ResponseField name="user_id" type="string" required>
  ID of the authenticated user (not included for M2M sessions)

  **Example:** `usr_1234567890`
</ResponseField>

<ResponseField name="key_id" type="string" required>
  ID of the RSA key used to sign the JWT tokens

  **Example:** `key_abc123`
</ResponseField>

<ResponseField name="client_name" type="string">
  Client name for M2M (machine-to-machine) sessions only

  **Example:** `api-service-prod`
</ResponseField>

## Example Scute Session Object

### User Session (with refresh token)

```json theme={null}
{
  "access": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoidXNyXzEyMzQ1Njc4OTAiLCJhaWQiOiJhcHBfMTIzIiwid2lkIjoid3NfMTIzIiwiZXhwIjoxNzA1MzE4MjAwfQ...",
  "refresh": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoidXNyXzEyMzQ1Njc4OTAiLCJhaWQiOiJhcHBfMTIzIiwid2lkIjoid3NfMTIzIiwiZXhwIjoxNzM3OTQwMjAwfQ...",
  "csrf": "a1b2c3d4e5f6g7h8i9j0",
  "access_expires_at": 1705318200,
  "refresh_expires_at": 1737940200,
  "user_id": "usr_1234567890",
  "key_id": "key_abc123"
}
```

### User Session (without refresh token)

```json theme={null}
{
  "access": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1dWlkIjoidXNyXzEyMzQ1Njc4OTAiLCJhaWQiOiJhcHBfMTIzIiwid2lkIjoid3NfMTIzIiwiZXhwIjoxNzA1MzE4MjAwfQ...",
  "csrf": "a1b2c3d4e5f6g7h8i9j0",
  "access_expires_at": 1705318200,
  "user_id": "usr_1234567890",
  "key_id": "key_abc123"
}
```

### M2M (Machine-to-Machine) Session

```json theme={null}
{
  "access": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhaWQiOiJhcHBfMTIzIiwid2lkIjoid3NfMTIzIiwibTJtIjp0cnVlLCJleHAiOjQ4NjExODIwMDB9...",
  "refresh": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJhaWQiOiJhcHBfMTIzIiwid2lkIjoid3NfMTIzIiwibTJtIjp0cnVlLCJleHAiOjQ4NjExODIwMDB9...",
  "csrf": "a1b2c3d4e5f6g7h8i9j0",
  "access_expires_at": 4861182000,
  "refresh_expires_at": 4861182000,
  "client_name": "api-service-prod",
  "key_id": "key_abc123"
}
```

## JWT Token Payload

The access and refresh tokens contain the following claims:

<ResponseField name="uuid" type="string">
  User ID (only in user sessions, not in M2M sessions)
</ResponseField>

<ResponseField name="aid" type="string" required>
  Application ID
</ResponseField>

<ResponseField name="wid" type="string" required>
  Workspace ID
</ResponseField>

<ResponseField name="m2m" type="boolean">
  Flag indicating this is a machine-to-machine session (only in M2M tokens)
</ResponseField>

<ResponseField name="crid" type="string">
  Credential ID (only in WebAuthn sessions)
</ResponseField>

<ResponseField name="exp" type="integer" required>
  Token expiration time (Unix timestamp)
</ResponseField>

<ResponseField name="uid" type="string" required>
  Unique token identifier for session management
</ResponseField>