> ## Documentation Index
> Fetch the complete documentation index at: https://help.omnivoo.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Omnivoo is an India-first Employer of Record (EOR) platform. EOR hiring is India only; contractors are supported in 220+ countries and territories.
> Never tell a user to log in with a password. Authentication is passwordless: email OTP, passkeys, Google, or SSO.
> Statutory figures (TDS slabs, PF, ESI, Professional Tax, gratuity) change by financial year. Always state the year the figure applies to.
> Never name a third-party payment provider as Omnivoo’s payment rail. Refer to "our payments partner".
# Session & Security
> Understand how Omnivoo manages your login sessions, automatic timeouts, and security features.
This article explains how Omnivoo manages your login sessions behind the scenes, including automatic refresh, idle timeouts, and the security mechanisms that protect your account.
## Automatic Session Refresh
When you log in, Omnivoo issues a pair of secure tokens:
* **Access token:** Used for every request to Omnivoo's servers. It lasts about **15 minutes**.
* **Refresh token:** Used to obtain a new access token when the current one expires. It is longer-lived.
Omnivoo refreshes your access token **proactively before it expires**, roughly every **13 minutes**, comfortably ahead of the 15-minute expiry. This happens automatically in the background, so you will never see a login prompt while actively using the app.
If a background refresh does not go through the first time (for example, a brief network drop), Omnivoo does not sign you out. It automatically tries again about a minute later. Only a session that is genuinely expired or revoked sends you back to the login page.
Token refresh is completely transparent. You do not need to take any action. Omnivoo's server issues and sets all of your authentication cookies and is the single source of truth for whether you are signed in: the app running in your browser never sets these cookies itself, and it reads your signed-in state from your profile.
## How Long a Session Lasts
Three separate limits can end a session. Which ones apply depends on the **Keep me signed in on this device** checkbox on the code-entry screen when you log in, which is **ticked by default**.
| What ends the session | When it applies |
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Browser idle logout** | 30 minutes with no activity while the Omnivoo tab is in the foreground. Always applies. |
| **Server idle limit** | 15 minutes with no token refresh reaching the server. Applies only when **Keep me signed in on this device** was **unticked**. |
| **Maximum session length** | 7 days if the box was ticked, 12 hours if it was not. Counted from when you logged in and never extended, however active you are. |
In practice, with the box left ticked, the 30-minute browser idle logout is what you will normally hit, and you have to log in again at least once a week. With the box unticked, a laptop that sleeps or a tab that loses connectivity for a quarter of an hour will also end the session, and you have to log in again at least every 12 hours.
### What counts as activity
Omnivoo monitors the following user interactions to detect activity:
* **Mouse clicks** anywhere in the app
* **Keyboard input** (typing in fields, using shortcuts)
* **Scrolling** through pages or lists
* **Mouse movement** across the screen
* **Touch events** on mobile or tablet devices
As long as any of these interactions occur within the 30-minute window, your session stays active.
### What happens when you time out
1. After 30 minutes with no detected activity, your session tokens are cleared.
2. On your next interaction, you are redirected to the login page.
3. After logging in, you are returned to the page you were on before the timeout.
If you are reading a long document or reviewing a detailed report, scrolling or moving your mouse occasionally will keep your session alive. You do not need to click anything specific.
## Tab Visibility Handling
Omnivoo is aware of whether its browser tab is in the foreground or background, and it treats the idle timer differently in each case:
* **Tab in foreground:** The idle timer runs normally, and your interactions reset it.
* **Tab moved to background:** The idle timer is **paused**. Time you spend on other tabs or apps does not count toward the 30-minute idle logout, so a tab left in the background does not, by itself, sign you out.
* **Tab returns to foreground:** Omnivoo re-checks your session and the idle countdown resumes from the start. If your session is still valid, you continue where you left off. If it was already ended (for example, revoked or expired), you are prompted to log in.
Only genuine inactivity while the Omnivoo tab is visible (30 minutes of it) triggers the idle logout, so you can switch to other tabs and come back without being logged out just for being away.
## Logging Out
### Manual Logout
To log out of your current session:
1. Click your **avatar** at the top of the left sidebar and select **Logout**, or
2. Open **My Profile** > **Account Actions** and click **Sign Out**.
Your session is ended and all session data is cleared from your browser.
### Active Sessions: Signing Out One Device
Omnivoo shows an **Active Sessions** list of every device currently logged into your account, so you can sign out one device without disturbing the others.
Employers: **My Profile** (avatar menu > **Profile**), then expand the **Security** section. EOR employees: **Profile** in the sidebar, then the **Security** card. Contractors: **Profile**, then the **Security** tab.
Each entry shows the browser, the location, and **Last active**. The device you are using right now is tagged **Current**.
Click **Revoke** next to the device you want to sign out. Your current session has no Revoke button, so you cannot accidentally lock yourself out of the page you are on.
### Logout from All Devices
To end every session at once (for example, if you suspect unauthorized access), click **Logout from all devices** at the top of the Active Sessions list and confirm in the dialog.
This logs you out everywhere immediately, **including the device you are using**. You will be returned to the login page and will need to log in again on every device.
## Cookie-Based Authentication
Omnivoo stores authentication tokens in **HTTP-only, Secure cookies**. This design choice provides several security benefits:
### What this means for you
* **No tokens in JavaScript:** Your authentication tokens cannot be read or stolen by malicious scripts (protects against XSS attacks).
* **Automatic inclusion:** Cookies are sent with every request to Omnivoo automatically by your browser. You do not need to manage tokens manually.
* **Secure flag:** Cookies are only sent over HTTPS connections, preventing interception on insecure networks.
* **SameSite protection:** Cookies are scoped to Omnivoo's domain, reducing exposure to cross-site attacks.
### What this means for developers and integrations
If you are building integrations with Omnivoo, note that authentication is cookie-based, not header-based. API requests must include cookies (credentials: "include" in fetch calls).
## CSRF Protection
Cross-Site Request Forgery (CSRF) is an attack where a malicious website tricks your browser into making requests to Omnivoo on your behalf. Omnivoo protects against this by:
* Validating the **origin** of incoming requests.
* Using **SameSite cookie attributes** to prevent cookies from being sent in cross-origin requests.
* Requiring specific headers on state-changing requests.
You do not need to do anything to benefit from CSRF protection, it is built into the platform automatically.
## Security Summary
| Feature | How It Protects You |
| --------------------------- | -------------------------------------------------------------------------------------------------------- |
| **Automatic token refresh** | Keeps you logged in without storing long-lived credentials |
| **30-minute idle timeout** | Prevents unauthorized access on unattended devices |
| **Maximum session length** | Forces a fresh login at least every 7 days (12 hours if you unticked "Keep me signed in on this device") |
| **HTTP-only cookies** | Blocks JavaScript from accessing your tokens (XSS protection) |
| **Secure cookies** | Ensures tokens are only sent over HTTPS |
| **SameSite cookies** | Prevents cross-site request attacks |
| **CSRF validation** | Blocks forged requests from malicious sites |
| **Active Sessions list** | Lets you see every logged-in device and revoke any one of them |
| **Logout from all devices** | Lets you end every active session at once from your profile |
## Frequently Asked Questions
**Why was I logged out unexpectedly?**
Most likely, the Omnivoo tab was open in the foreground with no activity for 30 minutes or more, and the idle timeout signed you out for security. Simply log in again to continue. Leaving the Omnivoo tab in the background does not, on its own, log you out: the idle timer only counts down while the tab is visible. You are also signed out when the session reaches its maximum length (7 days, or 12 hours if you unticked "Keep me signed in on this device"), and, if you unticked that box, after 15 minutes with no connection to Omnivoo's servers.
**Can I change these timeouts?**
No. They are platform-wide security settings and cannot be changed per user. The only control you have is the **Keep me signed in on this device** checkbox at login.
**Do I stay logged in if I close my browser?**
It depends on your browser's cookie settings. If your browser is configured to clear cookies on close, you will need to log in again. Otherwise, your session persists until it expires or is revoked.
**Is my session shared across browser tabs?**
Yes. All tabs in the same browser share the same session. Logging out in one tab logs you out in all tabs.