When a user logs into piper, a Session is created linking their userId to the tenantId they authenticated under. All subsequent API requests are validated against this session. The expiresAt field determines when the session becomes invalid and the user must re-authenticate through Suite SSO. Sessions are scoped per tenant, so a user with access to multiple organizations maintains separate sessions for each.
Technical section
Data model, API, and internals — visible to developers.