Controls how authenticated user sessions behave in this tenant.

Timeout

The number of minutes of inactivity after which a user session is automatically invalidated. The valid range is 1 – 1440 minutes (up to 24 hours). The default is 60 minutes.

Setting a very long timeout may increase the risk of session hijacking if a user leaves their browser unattended.

Enable CSRF Protection

When enabled (the default), the platform requires a CSRF token on all state-changing requests. This protects against Cross-Site Request Forgery attacks. Disable only in controlled environments where all clients are trusted and CSRF protection conflicts with an integration.

Disabling CSRF protection reduces security. Only turn this off if you fully understand the implications.