Skip to main content
This article explains how Omnivoo manages your login sessions behind the scenes, including automatic refresh, idle timeouts, and the security mechanisms that protect your account.

​
Automatic Session Refresh

When you log in, Omnivoo issues a pair of secure tokens:
  • Access token: Used for every request to Omnivoo’s servers. It lasts about 15 minutes.
  • Refresh token: Used to obtain a new access token when the current one expires. It is longer-lived.
Omnivoo refreshes your access token proactively before it expires, roughly every 13 minutes, comfortably ahead of the 15-minute expiry. This happens automatically in the background, so you will never see a login prompt while actively using the app. If a background refresh does not go through the first time (for example, a brief network drop), Omnivoo does not sign you out. It automatically tries again about a minute later. Only a session that is genuinely expired or revoked sends you back to the login page.
Token refresh is completely transparent. You do not need to take any action. Omnivoo’s server issues and sets all of your authentication cookies and is the single source of truth for whether you are signed in: the app running in your browser never sets these cookies itself, and it reads your signed-in state from your profile.

​
How Long a Session Lasts

Three separate limits can end a session. Which ones apply depends on the Keep me signed in on this device checkbox on the code-entry screen when you log in, which is ticked by default. In practice, with the box left ticked, the 30-minute browser idle logout is what you will normally hit, and you have to log in again at least once a week. With the box unticked, a laptop that sleeps or a tab that loses connectivity for a quarter of an hour will also end the session, and you have to log in again at least every 12 hours.

​
What counts as activity

Omnivoo monitors the following user interactions to detect activity:
  • Mouse clicks anywhere in the app
  • Keyboard input (typing in fields, using shortcuts)
  • Scrolling through pages or lists
  • Mouse movement across the screen
  • Touch events on mobile or tablet devices
As long as any of these interactions occur within the 30-minute window, your session stays active.

​
What happens when you time out

  1. After 30 minutes with no detected activity, your session tokens are cleared.
  2. On your next interaction, you are redirected to the login page.
  3. After logging in, you are returned to the page you were on before the timeout.
If you are reading a long document or reviewing a detailed report, scrolling or moving your mouse occasionally will keep your session alive. You do not need to click anything specific.

​
Tab Visibility Handling

Omnivoo is aware of whether its browser tab is in the foreground or background, and it treats the idle timer differently in each case:
  • Tab in foreground: The idle timer runs normally, and your interactions reset it.
  • Tab moved to background: The idle timer is paused. Time you spend on other tabs or apps does not count toward the 30-minute idle logout, so a tab left in the background does not, by itself, sign you out.
  • Tab returns to foreground: Omnivoo re-checks your session and the idle countdown resumes from the start. If your session is still valid, you continue where you left off. If it was already ended (for example, revoked or expired), you are prompted to log in.
Only genuine inactivity while the Omnivoo tab is visible (30 minutes of it) triggers the idle logout, so you can switch to other tabs and come back without being logged out just for being away.

​
Logging Out

​
Manual Logout

To log out of your current session:
  1. Click your avatar at the top of the left sidebar and select Logout, or
  2. Open My Profile > Account Actions and click Sign Out.
Your session is ended and all session data is cleared from your browser.

​
Active Sessions: Signing Out One Device

Omnivoo shows an Active Sessions list of every device currently logged into your account, so you can sign out one device without disturbing the others.
1

Open your profile

Employers: My Profile (avatar menu > Profile), then expand the Security section. EOR employees: Profile in the sidebar, then the Security card. Contractors: Profile, then the Security tab.
2

Find the device

Each entry shows the browser, the location, and Last active. The device you are using right now is tagged Current.
3

Click Revoke

Click Revoke next to the device you want to sign out. Your current session has no Revoke button, so you cannot accidentally lock yourself out of the page you are on.

​
Logout from All Devices

To end every session at once (for example, if you suspect unauthorized access), click Logout from all devices at the top of the Active Sessions list and confirm in the dialog.
This logs you out everywhere immediately, including the device you are using. You will be returned to the login page and will need to log in again on every device.
Omnivoo stores authentication tokens in HTTP-only, Secure cookies. This design choice provides several security benefits:

​
What this means for you

  • No tokens in JavaScript: Your authentication tokens cannot be read or stolen by malicious scripts (protects against XSS attacks).
  • Automatic inclusion: Cookies are sent with every request to Omnivoo automatically by your browser. You do not need to manage tokens manually.
  • Secure flag: Cookies are only sent over HTTPS connections, preventing interception on insecure networks.
  • SameSite protection: Cookies are scoped to Omnivoo’s domain, reducing exposure to cross-site attacks.

​
What this means for developers and integrations

If you are building integrations with Omnivoo, note that authentication is cookie-based, not header-based. API requests must include cookies (credentials: “include” in fetch calls).

​
CSRF Protection

Cross-Site Request Forgery (CSRF) is an attack where a malicious website tricks your browser into making requests to Omnivoo on your behalf. Omnivoo protects against this by:
  • Validating the origin of incoming requests.
  • Using SameSite cookie attributes to prevent cookies from being sent in cross-origin requests.
  • Requiring specific headers on state-changing requests.
You do not need to do anything to benefit from CSRF protection, it is built into the platform automatically.

​
Security Summary

​
Frequently Asked Questions

Why was I logged out unexpectedly? Most likely, the Omnivoo tab was open in the foreground with no activity for 30 minutes or more, and the idle timeout signed you out for security. Simply log in again to continue. Leaving the Omnivoo tab in the background does not, on its own, log you out: the idle timer only counts down while the tab is visible. You are also signed out when the session reaches its maximum length (7 days, or 12 hours if you unticked “Keep me signed in on this device”), and, if you unticked that box, after 15 minutes with no connection to Omnivoo’s servers. Can I change these timeouts? No. They are platform-wide security settings and cannot be changed per user. The only control you have is the Keep me signed in on this device checkbox at login. Do I stay logged in if I close my browser? It depends on your browser’s cookie settings. If your browser is configured to clear cookies on close, you will need to log in again. Otherwise, your session persists until it expires or is revoked. Is my session shared across browser tabs? Yes. All tabs in the same browser share the same session. Logging out in one tab logs you out in all tabs.