Short-lived Bearer token for calling APIs.
Unix timestamp (seconds) at which the access token expires.
Optional scopeScopes granted to this anonymous session.
Optional sessiontrue when getAccessToken() was called with a sessionToken that had
expired or been invalidated, and a fresh anonymous identity was silently
created to replace it.
When true the returned sessionToken belongs to a new identity —
the previous sub, any attached metadata, and any server-side state keyed
to the old identity are permanently gone.
Absent when createSession() is called directly or when getAccessToken()
is called without a sessionToken.
Long-lived handle for the anonymous identity. Never sent to APIs directly. Used by the SDK to re-mint access tokens.
Optional sessionUnix timestamp (seconds) at which the session token itself expires.
The session token is minted once and never reissued, so this value counts
down on every response rather than resetting. Absent when the API response
does not include session_expires_in.
Use this — not expiresAt — to drive cookie Max-Age or session expiry UI.
Represents an active anonymous session.
Stores both the long-lived session token (used to re-mint access tokens) and the current short-lived access token (used to call APIs).