--- title: Session Token Persistence Settings description: Manage PingOne session token cookie persistence settings component: pingone-api page_id: pingone-api:platform:session-token-settings/index canonical_url: https://developer.pingidentity.com/pingone-api/platform/session-token-settings/index.html llms_txt: https://developer.pingidentity.com/pingone-api/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-08-11 section_ids: persistent-session-token-cookie-behavior: Persistent session token cookie behavior non-persistent-session-token-cookie-behavior: Non-persistent session token cookie behavior assigning-admin-roles-and-permissions-to-this-service: Assigning admin roles and permissions to this service session-data-model: Session data model sso-session-token-cookie-settings-events-generated: SSO session token cookie settings events generated response-codes: Response codes --- # Session Token Persistence Settings In PingOne, flow endpoints use a session token cookie to associate an authenticated user with the flow session. For flows started through the authorize endpoint that call the read flow endpoint, a session token cookie is set only after the identity of the user has been partially established. PingOne environments include a session token cookie persistence setting that gives administrators control over persistence behavior of the session token cookie for the environment. The admin can set persistent cookies that remain valid after a user closes the current browser session, or non-persistent cookies that are deleted after the user closes the browser. ## Persistent session token cookie behavior By default, PingOne sets the SSO session token cookie as a persistent cookie. For PingOne sign-on policies, the idle timeout is 30 days (this is not configurable). For DaVinci flow policies, administrators can configure the idle timeout setting in the following DaVinci flow nodes: * Return Success Response (Redirect Flows) * Return Success Response (Widget Flows) * Return CIBA Success The session token cookie persists until its expiry time. If the invoked authentication policy is configured with the last sign-on older than the specified condition or an invoked DaVinci flow uses the Check Session capability from the PingOne Authentication Connector, restarting the browser results in successful sign-on unless: * The session expires. * The user signs off. * An admin process terminates the session using the PingOne admin console or the session API. * PingOne purges the session. ## Non-persistent session token cookie behavior An environment configured for non-persistent session token cookies clears the session token cookie after the browser closes completely. For users who share a device in the workplace, this action provides session termination without relying on explicit signoff. Deleting the cookie does not end the server-side session or invalidate tokens immediately. This behavior can lead to session accumulation. PingOne limits the number of sessions to 10. If a user creates a new session after the limit is reached, the oldest session is deleted to allow the new sign-on session. The session object's `expiresAt` timestamp has a default duration of 30 days. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | In environments configured with non-persistent session token cookies, session and state information cannot persist across browser restarts, regardless of product-level time-to-live settings. This can lead to unexpected behavior across PingOne services. For example, if a DaVinci flow policy or PingOne authentication policy is configured to support long-lived sessions or remembered devices, exiting the browser ignores these settings, forces session termination, and prompts the user to fully re-authenticate on return. | ## Assigning admin roles and permissions to this service Admin role assignments determine access to PingOne APIs. When assigning admin roles to this service, refer to [PingOne Permissions by Service](../reference/roles-and-permissions-in-pingone/permissions-by-service.html) for the service-specific permissions. You can also choose to assign admin roles based on particular service resources. Refer to [PingOne Permissions by Resource](../reference/roles-and-permissions-in-pingone/permissions-by-resource.html) when assigning admin roles per service resources. Admin assignments to roles are set by: * [Automatic assignment for some roles](../roles/predefined-roles/index.html#automatic-role-assignment). * [Group Role Assignments](../group-role-assignments/index.html). * [User Role Assignments](../users/user-role-assignments/index.html). Refer to [Roles Management](../roles/index.html) for more information. ## Session data model | Property | Type | Required | Mutable | Description | | ------------------------------------ | ------- | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | `useNonPersistentSessionTokenCookie` | Boolean | Optional | Mutable | Specifies whether the environment supports persistent or non-persistent session token cookies. If this property is not set, the default value is `false`. | ## SSO session token cookie settings events generated Refer to [Audit Reporting Events](../reference/audit-reporting-events.html) for the events generated. ## Response codes | Code | Message | | ---- | ----------------------------------- | | 200 | Successful operation. | | 400 | The request could not be completed. |