Bearer token for API calls; validates per access_token JWT expiry
Unix seconds at which accessToken expires
Anonymous subject, always "anon@{uuid}" (extracted from access token sub claim)
OptionalmetadataUser-set top-level key-value metadata, max 1KB serialized, optional
Session object returned to SDK consumers (access token exposed, session token stays server-side)