From 5f21fca11d52007e71354a21f9babda7730a04d5 Mon Sep 17 00:00:00 2001 From: Srinivas Karre Date: Wed, 6 May 2026 06:20:44 +0530 Subject: [PATCH 1/4] feat: add organization session policy documentation Adds a new page covering GetOrganizationSessionPolicy and UpdateOrganizationSessionPolicy with code examples in all four SDK languages. Updates manage-session.mdx with a section and seeAlso link, and adds the page to the sidebar under "Manage users & orgs". --- src/configs/sidebar.config.ts | 1 + .../docs/authenticate/fsa/manage-session.mdx | 9 + .../organization-session-policy.mdx | 299 ++++++++++++++++++ 3 files changed, 309 insertions(+) create mode 100644 src/content/docs/authenticate/manage-organizations/organization-session-policy.mdx diff --git a/src/configs/sidebar.config.ts b/src/configs/sidebar.config.ts index f3d8381e3..08188defa 100644 --- a/src/configs/sidebar.config.ts +++ b/src/configs/sidebar.config.ts @@ -51,6 +51,7 @@ export const sidebar = [ 'authenticate/manage-organizations/remove-users-from-organization', 'authenticate/manage-users-orgs/delete-users-and-organizations', 'authenticate/fsa/user-management-settings', + 'authenticate/manage-organizations/organization-session-policy', 'authenticate/manage-users-orgs/hosted-widgets', ], }, diff --git a/src/content/docs/authenticate/fsa/manage-session.mdx b/src/content/docs/authenticate/fsa/manage-session.mdx index 5646fc68a..c563eeded 100644 --- a/src/content/docs/authenticate/fsa/manage-session.mdx +++ b/src/content/docs/authenticate/fsa/manage-session.mdx @@ -19,6 +19,9 @@ seeAlso: - title: "Preserve destination post login" icon: "book" url: "/guides/user-auth/preserve-intended-destination/" + - title: "Organization session policy" + icon: "book" + url: "/authenticate/manage-organizations/organization-session-policy/" --- import { @@ -660,3 +663,9 @@ This guide shows you how to store these tokens securely with encryption and prop Your application continuously validates the access token for each incoming request. When the token is valid, the user's session remains active. If the access token expires, your middleware transparently refreshes it using the stored refresh token—users never notice this happening. If the refresh token itself expires or becomes invalid, users are prompted to sign in again. + +## Organization session policy + +Enterprise customers sometimes require session durations that differ from your application defaults. Scalekit lets you set a custom session policy per organization — controlling absolute timeout and idle timeout independently — while always applying the stricter of the two values at session creation. + +[Learn how to configure organization session policies →](/authenticate/manage-organizations/organization-session-policy/) diff --git a/src/content/docs/authenticate/manage-organizations/organization-session-policy.mdx b/src/content/docs/authenticate/manage-organizations/organization-session-policy.mdx new file mode 100644 index 000000000..dcef3def3 --- /dev/null +++ b/src/content/docs/authenticate/manage-organizations/organization-session-policy.mdx @@ -0,0 +1,299 @@ +--- +title: "Organization session policy" +description: "Override application-level session timeouts for specific organizations with custom absolute and idle session policies" +tags: [organizations, session, policy, timeout, security] +sidebar: + label: "Organization session policy" +tableOfContents: true +head: + - tag: style + content: | + .sl-markdown-content h2 { + font-size: var(--sl-text-xl); + } +--- + +import { Aside, Tabs, TabItem } from '@astrojs/starlight/components'; + +By default, all organizations inherit the session policy configured at the application level — covering absolute session duration and idle timeout. When an enterprise customer requires stricter or different session controls than your application defaults, you can set a custom session policy on a per-organization basis. + +Scalekit always enforces the **stricter of the two** (application vs. organization) at session creation time, so organization policies can only tighten — not relax — your application-level defaults. + +## Session policy settings + +| Setting | Description | +|---|---| +| `policySource` | `APPLICATION` (inherit defaults) or `CUSTOM` (use per-org values) | +| `absoluteSessionTimeout` | Maximum session lifetime regardless of activity | +| `absoluteSessionTimeoutUnit` | Unit for absolute timeout: `MINUTES`, `HOURS`, or `DAYS` | +| `idleSessionTimeoutEnabled` | Whether idle timeout is active for this organization | +| `idleSessionTimeout` | Time after which an idle session expires | +| `idleSessionTimeoutUnit` | Unit for idle timeout: `MINUTES`, `HOURS`, or `DAYS` | + + + +## Get the current session policy + +Retrieve the active session policy for an organization to display it in your settings UI or audit the current configuration. + + + + +```javascript +const policy = await scalekit.organization.getOrganizationSessionPolicy('org_12345'); + +if (policy.policySource === 'CUSTOM') { + console.log('Absolute timeout:', policy.absoluteSessionTimeout, policy.absoluteSessionTimeoutUnit); + console.log('Idle timeout enabled:', policy.idleSessionTimeoutEnabled); +} +``` + + + + +```python +from scalekit.v1.organizations.organizations_pb2 import SessionPolicySource + +policy = scalekit_client.organization.get_organization_session_policy('org_12345') + +if policy.policy_source == SessionPolicySource.CUSTOM: + print('Absolute timeout:', policy.absolute_session_timeout.value, policy.absolute_session_timeout_unit) + print('Idle timeout enabled:', policy.idle_session_timeout_enabled.value) +``` + + + + +```go +policy, err := scalekitClient.Organization.GetOrganizationSessionPolicy(ctx, "org_12345") +if err != nil { + log.Fatal(err) +} + +if policy.PolicySource == scalekit.SessionPolicySourceCustom { + fmt.Println("Absolute timeout:", policy.AbsoluteSessionTimeout, policy.AbsoluteSessionTimeoutUnit) + fmt.Println("Idle timeout enabled:", policy.IdleSessionTimeoutEnabled) +} +``` + + + + +```java +import com.scalekit.grpc.scalekit.v1.organizations.OrganizationSessionPolicySettings; +import com.scalekit.grpc.scalekit.v1.organizations.SessionPolicySource; + +OrganizationSessionPolicySettings policy = + scalekitClient.organizations().getOrganizationSessionPolicy("org_12345"); + +if (policy.getPolicySource() == SessionPolicySource.CUSTOM) { + System.out.println("Absolute timeout: " + policy.getAbsoluteSessionTimeout().getValue() + + " " + policy.getAbsoluteSessionTimeoutUnit()); + System.out.println("Idle timeout enabled: " + policy.getIdleSessionTimeoutEnabled().getValue()); +} +``` + + + + +## Set a custom session policy + +Apply a custom policy when an organization requires different session durations than your application defaults. + + + + +```javascript +const updated = await scalekit.organization.updateOrganizationSessionPolicy('org_12345', { + policySource: 'CUSTOM', + absoluteSessionTimeout: 480, + absoluteSessionTimeoutUnit: 'MINUTES', + idleSessionTimeoutEnabled: true, + idleSessionTimeout: 60, + idleSessionTimeoutUnit: 'MINUTES', +}); + +console.log('Policy updated:', updated.policySource); +``` + + + + +```python +from scalekit.v1.organizations.organizations_pb2 import SessionPolicySource +from scalekit.v1.commons.commons_pb2 import TimeUnit + +updated = scalekit_client.organization.update_organization_session_policy( + organization_id='org_12345', + policy_source=SessionPolicySource.CUSTOM, + absolute_session_timeout=480, + absolute_session_timeout_unit=TimeUnit.MINUTES, + idle_session_timeout_enabled=True, + idle_session_timeout=60, + idle_session_timeout_unit=TimeUnit.MINUTES, +) + +print('Policy updated:', updated.policy_source) +``` + + + + +```go +timeout := int32(480) +idleTimeout := int32(60) +idleEnabled := true + +updated, err := scalekitClient.Organization.UpdateOrganizationSessionPolicy(ctx, "org_12345", scalekit.OrganizationSessionPolicy{ + PolicySource: scalekit.SessionPolicySourceCustom, + AbsoluteSessionTimeout: &timeout, + AbsoluteSessionTimeoutUnit: scalekit.TimeUnitMinutes, + IdleSessionTimeoutEnabled: &idleEnabled, + IdleSessionTimeout: &idleTimeout, + IdleSessionTimeoutUnit: scalekit.TimeUnitMinutes, +}) +if err != nil { + log.Fatal(err) +} + +fmt.Println("Policy updated:", updated.PolicySource) +``` + + + + +```java +import com.google.protobuf.Int32Value; +import com.google.protobuf.BoolValue; +import com.scalekit.grpc.scalekit.v1.commons.TimeUnit; +import com.scalekit.grpc.scalekit.v1.organizations.OrganizationSessionPolicySettings; +import com.scalekit.grpc.scalekit.v1.organizations.SessionPolicySource; + +OrganizationSessionPolicySettings policy = OrganizationSessionPolicySettings.newBuilder() + .setPolicySource(SessionPolicySource.CUSTOM) + .setAbsoluteSessionTimeout(Int32Value.of(480)) + .setAbsoluteSessionTimeoutUnit(TimeUnit.MINUTES) + .setIdleSessionTimeoutEnabled(BoolValue.of(true)) + .setIdleSessionTimeout(Int32Value.of(60)) + .setIdleSessionTimeoutUnit(TimeUnit.MINUTES) + .build(); + +OrganizationSessionPolicySettings updated = + scalekitClient.organizations().updateOrganizationSessionPolicy("org_12345", policy); + +System.out.println("Policy updated: " + updated.getPolicySource()); +``` + + + + +## Revert to application defaults + +Remove a custom policy and restore the organization to the application-level session settings. + + + + +```javascript +await scalekit.organization.updateOrganizationSessionPolicy('org_12345', { + policySource: 'APPLICATION', +}); +``` + + + + +```python +from scalekit.v1.organizations.organizations_pb2 import SessionPolicySource + +scalekit_client.organization.update_organization_session_policy( + organization_id='org_12345', + policy_source=SessionPolicySource.APPLICATION, +) +``` + + + + +```go +_, err := scalekitClient.Organization.UpdateOrganizationSessionPolicy(ctx, "org_12345", scalekit.OrganizationSessionPolicy{ + PolicySource: scalekit.SessionPolicySourceApplication, +}) +if err != nil { + log.Fatal(err) +} +``` + + + + +```java +import com.scalekit.grpc.scalekit.v1.organizations.OrganizationSessionPolicySettings; +import com.scalekit.grpc.scalekit.v1.organizations.SessionPolicySource; + +OrganizationSessionPolicySettings policy = OrganizationSessionPolicySettings.newBuilder() + .setPolicySource(SessionPolicySource.APPLICATION) + .build(); + +scalekitClient.organizations().updateOrganizationSessionPolicy("org_12345", policy); +``` + + + + +## Enable the session_policy feature + +Organization-level session policies are controlled by the `session_policy` feature flag. Enable it before applying a custom policy. + + + + +```javascript +await scalekit.organization.updateOrganizationSettings('org_12345', { + features: [{ name: 'session_policy', enabled: true }], +}); +``` + + + + +```python +scalekit_client.organization.update_organization_settings( + organization_id='org_12345', + settings=[{'name': 'session_policy', 'enabled': True}], +) +``` + + + + +```go +import organizationsv1 "github.com/scalekit-inc/scalekit-sdk-go/v2/pkg/grpc/scalekit/v1/organizations" + +_, err := scalekitClient.Organization.UpdateOrganizationSettings(ctx, "org_12345", + []*organizationsv1.OrganizationSettingsFeature{ + {Name: "session_policy", Enabled: true}, + }, +) +``` + + + + +```java +import com.scalekit.grpc.scalekit.v1.organizations.OrganizationSettingsFeature; +import java.util.List; + +scalekitClient.organizations().updateOrganizationSettings( + "org_12345", + List.of(OrganizationSettingsFeature.newBuilder() + .setName("session_policy") + .setEnabled(true) + .build()) +); +``` + + + From d07732489a919690708956c99526df7632fd7bda Mon Sep 17 00:00:00 2001 From: Srinivas Karre Date: Wed, 6 May 2026 06:21:20 +0530 Subject: [PATCH 2/4] chore: regenerate D2 diagram SVGs --- .../authentication/token-management-0.svg | 2 +- .../agentkit/mcp/configure-mcp-server-0.svg | 2 +- .../agentkit/mcp/configure-mcp-server-1.svg | 2 +- .../agentkit/mcp/configure-mcp-server-2.svg | 2 +- public/d2/docs/agentkit/openclaw-0.svg | 2 +- public/d2/docs/agentkit/overview-0.svg | 2 +- .../d2/docs/agentkit/user-verification-0.svg | 2 +- .../auth-methods/authentication-flow-0.svg | 2 +- .../authz/create-roles-permissions-0.svg | 2 +- .../authz/implement-access-control-0.svg | 2 +- .../d2/docs/authenticate/authz/overview-0.svg | 2 +- .../fsa/multiapp/native-app-0.svg | 2 +- .../authenticate/fsa/multiapp/overview-0.svg | 2 +- .../fsa/multiapp/single-page-app-0.svg | 2 +- .../authenticate/fsa/multiapp/web-app-0.svg | 2 +- .../implement-webhooks-0.svg | 2 +- .../interceptors/auth-flow-interceptors-0.svg | 2 +- .../m2m/api-auth-quickstart-0.svg | 2 +- .../d2/docs/authenticate/m2m/api-keys-0.svg | 2 +- .../custom-user-attributes-0.svg | 2 +- .../email-domain-rules-0.svg | 2 +- .../email-domain-rules-1.svg | 2 +- .../manage-users-orgs/hosted-widgets-0.svg | 2 +- .../manage-users-orgs/jit-provisioning-0.svg | 2 +- .../manage-users-orgs/merge-identities-0.svg | 2 +- .../manage-users-orgs/merge-identities-1.svg | 2 +- .../manage-users-orgs/scim-provisioning-0.svg | 2 +- .../docs/authenticate/mcp/auth-patterns-0.svg | 2 +- .../docs/authenticate/mcp/auth-patterns-1.svg | 2 +- .../docs/authenticate/mcp/auth-patterns-2.svg | 2 +- .../docs/authenticate/mcp/auth-patterns-3.svg | 2 +- .../docs/authenticate/mcp/auth-patterns-4.svg | 2 +- .../docs/authenticate/mcp/custom-auth-0.svg | 2 +- .../mcp/expressjs-quickstart-0.svg | 2 +- .../mcp/fastapi-fastmcp-quickstart-0.svg | 2 +- .../authenticate/mcp/fastmcp-quickstart-0.svg | 2 +- .../authenticate/mcp/intro-to-mcp-auth-0.svg | 2 +- .../authenticate/mcp/intro-to-mcp-auth-1.svg | 2 +- .../authenticate/mcp/intro-to-mcp-auth-2.svg | 2 +- .../d2/docs/authenticate/mcp/overview-0.svg | 2 +- .../d2/docs/authenticate/mcp/overview-1.svg | 2 +- .../d2/docs/authenticate/mcp/overview-2.svg | 2 +- .../d2/docs/authenticate/mcp/overview-3.svg | 2 +- .../mcp/topologies/agent-mcp-0.svg | 2 +- .../mcp/topologies/human-mcp-0.svg | 2 +- .../authenticate/mcp/topologies/mcp-api-0.svg | 2 +- .../authenticate/mcp/topologies/mcp-api-1.svg | 2 +- .../authenticate/mcp/topologies/mcp-api-2.svg | 2 +- .../render-github-pr-summarizer-0.svg | 195 ------------------ .../tools/use-scalekit-credentials-0.svg | 2 +- .../guides/group-based-role-assignment-0.svg | 2 +- .../d2/docs/directory/scim/quickstart-0.svg | 2 +- public/d2/docs/fsa/data-modelling-0.svg | 2 +- public/d2/docs/fsa/guides/manage-users-0.svg | 2 +- .../d2/docs/fsa/guides/user-invitations-0.svg | 2 +- .../integrations/auth-systems/firebase-0.svg | 2 +- .../integrations/auth-systems/firebase-1.svg | 2 +- .../guides/sso/sso-migration-strategy-0.svg | 2 +- .../guides/sso/sso-migration-strategy-1.svg | 2 +- .../docs/mcp/auth-methods/custom-auth-0.svg | 2 +- .../d2/docs/mcp/auth-methods/enterprise-0.svg | 2 +- public/d2/docs/passwordless/oidc-0.svg | 2 +- public/d2/docs/sso/guides/idp-init-sso-0.svg | 2 +- public/d2/docs/sso/guides/idp-init-sso-1.svg | 2 +- 64 files changed, 63 insertions(+), 258 deletions(-) delete mode 100644 public/d2/docs/cookbooks/render-github-pr-summarizer-0.svg diff --git a/public/d2/docs/agentkit/authentication/token-management-0.svg b/public/d2/docs/agentkit/authentication/token-management-0.svg index e658be0fa..36ba4c950 100644 --- a/public/d2/docs/agentkit/authentication/token-management-0.svg +++ b/public/d2/docs/agentkit/authentication/token-management-0.svg @@ -1,4 +1,4 @@ - - - - - - - - - - - - -PR Summarizer — runtime flowTeam memberRender WorkflowScalekitGitHubClaude trigger summarizePRs(userId, owner, repo) list open PRs for userId fetch PRs with user's OAuth token+ diffs & comments top 5 PRs, diffs, threads summarize 5 PRs plain-language summary - - - - - - - - diff --git a/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg b/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg index cb46e0dd0..256430d62 100644 --- a/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg +++ b/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg @@ -1,4 +1,4 @@ - + + + + + + + + + + + +PR Summarizer — runtime flowTeam memberRender WorkflowScalekitGitHubClaude trigger summarizePRs(userId, owner, repo) list open PRs for userId fetch PRs with user's OAuth token+ diffs & comments top 5 PRs, diffs, threads summarize 5 PRs plain-language summary + + + + + + + + diff --git a/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg b/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg index 256430d62..cb46e0dd0 100644 --- a/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg +++ b/public/d2/docs/dev-kit/tools/use-scalekit-credentials-0.svg @@ -1,4 +1,4 @@ -