> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> ### Authlete versions
> Authlete 3.0 is the current version. Unless the user says they use another version, answer for Authlete 3.0 using the 3.x documentation.
> Documentation for Authlete 2.x (pages under `/v2/` and `/ja/v2/`) is for the legacy version. Refer to it only when the user is on Authlete 2.x.
>
> ### Authlete architecture
> Authlete is a backend engine for OAuth 2.0 and OpenID Connect processing. End users and client applications do not call it directly; the service provider's authorization server and API server call Authlete's APIs. Authlete handles protocol processing and token, client, and service management, while the service provider owns the OAuth/OIDC endpoints and user authentication.
> See [Architecture](https://developers.authlete.com/get-started/introduction-to-authlete/architecture.md).
>
> ### Concepts
> If the user is new to Authlete, read these pages first:
> - [Request and Response](https://developers.authlete.com/get-started/concepts/request-and-response.md): Core API requests pass the client's request parameters as-is, and responses return `resultCode`, `action`, and `responseContent`.
> - [Action Handling](https://developers.authlete.com/get-started/concepts/action-handling.md): Branch on `action`, never on `resultCode`, and map each action to the HTTP response your server returns.
> - [Two-Step API Calls](https://developers.authlete.com/get-started/concepts/two-step-api-calls.md): Actions such as `INTERACTION` are completed with a second call (`/auth/authorization/issue` or `/auth/authorization/fail`) linked by a `ticket`.
> - [Management API Overview](https://developers.authlete.com/get-started/concepts/overview.md): The Management API configures services, manages clients, and operates issued tokens, separately from the protocol flows handled by the Core API.
> - [API Authentication](https://developers.authlete.com/get-started/concepts/authentication.md): Authlete APIs use bearer tokens: a Service Access Token (one service) or an Organization Token (the whole organization).

# Security

> Explains how to set the inactivity timeout and the absolute session timeout that apply to every user in the environment.

> [!NOTE]
>
> This article applies only to Self-Managed and Dedicated Cloud environments. The shared environment (Shared Cloud) is managed by Authlete and is out of scope for this document.

The Security page sets the session policy for the environment. It's available to Environment Admins and Platform Admins only.

## Sessions

On the Session Management tab, you set two independent timeouts. Both apply to all users in the environment, regardless of which organizations they belong to.

* **Inactivity Timeout:** the period of inactivity after which a user is automatically signed out. Enter the value in minutes. The default is 30 minutes.
* **Absolute Session Timeout:** the maximum length of a session before re-authentication is required, regardless of activity. Enter the value in hours. The default is 24 hours.

Each value must be a positive number, and the absolute session timeout can't be shorter than the inactivity timeout. Edit either value, then save. Discard restores the values that were last saved.

In the shared environment, which Authlete manages, the session timeouts are fixed at the default values (30 minutes of inactivity and 24 hours absolute) and can't be changed.

Both timeouts terminate a session through the same shared path, which also revokes the associated Console access token, so the behavior is identical no matter which timer fires.

Changes to either timeout are recorded in [Audit Logs](https://developers.authlete.com/configuration-reference/environment/audit-logs.md).

> [!NOTE]
>
> An absolute session-lifetime cap supports the session termination requirement in [FedRAMP AC-12](https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-12/).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.