Session Settings
How signed-in sessions work, what happens when they expire, and how to sign out.
A session in the In-Store App is the period during which a signed-in user can use the app without signing in again. Sessions are backed by a JWT token issued by your organisation's identity provider (Microsoft Entra ID or Azure AD B2C). The app itself has no controls for adjusting session length — that is configured in the identity provider or back-office tenant settings. This page explains how the session lifecycle works and what staff should do when a session ends.
The inactivity lock in Multi-User mode (Settings → Multi-User → Multi-User Settings → Inactivity Timeout) is separate from the session. The inactivity lock switches the device to the employee selection screen after a period of inactivity, but the underlying session remains active. See Lock Screen and PIN for details.
How a session starts
Signing in creates a session. The app exchanges the identity provider token for an Omnium API token, which is stored securely on the device. From that point onwards, the token is attached automatically to every API request the app makes.
For the full sign-in walkthrough, see Logging In.
How the app checks session validity
Before sending any API request, the app checks whether the stored token has expired. If it has, the request is made without a token, the server returns a 401 Unauthorised response, and the app clears the stored token from the device.
| Condition | What the app does |
|---|---|
| Token is valid | Request proceeds normally |
| Token is locally expired (checked before the request) | Request is sent without a token; the server rejects it |
| Server returns 401 Unauthorised | Stored token is cleared |
What staff see when a session expires
When a session expires mid-use, the next action that contacts the server will fail. The exact message depends on where in the app the request was made:
| Location | Message shown |
|---|---|
| Carts page | Session expired. Please log in again. |
| Other pages | A general error message is shown |
After the token is cleared, tapping actions that require the server will continue to fail until the staff member signs in again. The quickest remedy is to go to Settings and tap Logout to return to the sign-in screen, then sign in again with a fresh session.
Signing out manually
Signing out clears the session from the device and returns to the email sign-in screen.
- Open Settings (tap the gear icon in the sidebar).
- Scroll to the Account section at the bottom.
- Tap Logout.
The session token is removed and any OAuth browser session is also ended, so the next sign-in will prompt for credentials again.
On Android, the app opens the identity provider's logout endpoint in an external browser to clear the browser session. You may briefly see a browser window open and close automatically.
Session length and configuration
Session length is determined by the access token lifetime set in your organisation's identity provider (Entra ID or Azure AD B2C). These settings are managed by your IT administrator, not within the In-Store App.
If sessions are expiring too frequently and disrupting store operations, contact your IT administrator or Omnium system administrator to review the token lifetime settings.