PingOne Platform APIs

Session Token Persistence Settings

In PingOne, flow endpoints use a session token cookie to associate an authenticated user with the flow session. For flows started through the authorize endpoint that call the read flow endpoint, a session token cookie is set only after the identity of the user has been partially established.

PingOne environments include a session token cookie persistence setting that gives administrators control over persistence behavior of the session token cookie for the environment. The admin can set persistent cookies that remain valid after a user closes the current browser session, or non-persistent cookies that are deleted after the user closes the browser.

By default, PingOne sets the SSO session token cookie as a persistent cookie. For PingOne sign-on policies, the idle timeout is 30 days (this is not configurable). For DaVinci flow policies, administrators can configure the idle timeout setting in the following DaVinci flow nodes:

  • Return Success Response (Redirect Flows)

  • Return Success Response (Widget Flows)

  • Return CIBA Success

The session token cookie persists until its expiry time. If the invoked authentication policy is configured with the last sign-on older than the specified condition or an invoked DaVinci flow uses the Check Session capability from the PingOne Authentication Connector, restarting the browser results in successful sign-on unless:

  • The session expires.

  • The user signs off.

  • An admin process terminates the session using the PingOne admin console or the session API.

  • PingOne purges the session.

An environment configured for non-persistent session token cookies clears the session token cookie after the browser closes completely. For users who share a device in the workplace, this action provides session termination without relying on explicit signoff.

Deleting the cookie does not end the server-side session or invalidate tokens immediately. This behavior can lead to session accumulation. PingOne limits the number of sessions to 10. If a user creates a new session after the limit is reached, the oldest session is deleted to allow the new sign-on session. The session object’s expiresAt timestamp has a default duration of 30 days.

In environments configured with non-persistent session token cookies, session and state information cannot persist across browser restarts, regardless of product-level time-to-live settings. This can lead to unexpected behavior across PingOne services. For example, if a DaVinci flow policy or PingOne authentication policy is configured to support long-lived sessions or remembered devices, exiting the browser ignores these settings, forces session termination, and prompts the user to fully re-authenticate on return.

Assigning admin roles and permissions to this service

Admin role assignments determine access to PingOne APIs. When assigning admin roles to this service, refer to PingOne Permissions by Service for the service-specific permissions.

You can also choose to assign admin roles based on particular service resources. Refer to PingOne Permissions by Resource when assigning admin roles per service resources.

Admin assignments to roles are set by:

Refer to Roles Management for more information.

Session data model

Property Type Required Mutable Description

useNonPersistentSessionTokenCookie

Boolean

Optional

Mutable

Specifies whether the environment supports persistent or non-persistent session token cookies. If this property is not set, the default value is false.

Refer to Audit Reporting Events for the events generated.

Response codes

Code Message

200

Successful operation.

400

The request could not be completed.