Session Persistence And Recovery

Operator wants the next session to start already-logged-in to a SaaS dashboard.

Create a Context via the documented Contexts API (or SDK). Pass contextId on POST /v1/sessions to attach. The session boots with the prior cookies + localStorage. Persist contextId per tenant in operator storage.

Two tenants share an operator backend. Operator looks up contextId by user email but key collisions cause tenant A to resume tenant B's session.

Key context storage by (tenant_id, user_id, target_domain). Never key only by email. Validate the resumed session against the expected tenant identity before exposing the browser back to the user. Treat any mismatch as a security incident.

Saved contextId has not been used for the documented retention window [REQUIRES-VERIFICATION on exact TTL]. POST /v1/sessions with that contextId errors.

Detect retention-expiry error specifically, fall back to fresh login flow, and create a new Context on success. Do not retry the same expired contextId — that burns concurrency slots.