Sessions and tokens

Every storefront session runs against a signed token. It is issued when the session starts and refreshed while the shopper is active.

Issuing a session

The storefront requests a session at load. The response is a short-lived access token that subsequent calls carry. Origin is validated when the session is issued.

Refresh

Tokens are refreshed against the existing session rather than by re-issuing a new identity, so a long shopping session does not fragment into several.

What the token is not

The session token identifies a storefront session. It is not a customer authorization grant, and it is not a substitute for your own authentication on any endpoint that exposes customer data.

Note on this page

Described from the current implementation rather than from a published contract. Field names and shapes are what Neomi normalizes to today; our engineering team confirms the public naming when the reference is finalized.