v4.144.0

Choose how long people stay signed in to your app's website

• run402 auth settings --browser-session-idle-seconds <n|default> --browser-session-max-seconds <n|default> sets how long a website sign-in may go unused before it ends, and its longest life from signing in. Whole seconds from 3600 (an hour) to 7776000 (90 days); default restores 12 hours and 30 days.
• SDK: r.auth.settings(projectId, { browser_session_idle_seconds, browser_session_max_seconds }), with null for the default. The SDK checks only that each value is a whole number or null; the server checks the range and that the idle window does not exceed the longest life (400 VALIDATION_FAILED). The settings result reports both values in effect.

On the platform side (already live): a website sign-in now lasts while it is used. The session cookie lasts to the session's longest life, and the server ends a session left unused past its idle window. Before, every website sign-in ended 12 hours after signing in, however much it was used. A shorter window applies at once to people already signed in.