# Sessions and JWTs
URL: https://docs.awellhealth.com/docs/embed-and-host/sessions-and-jwts

> For the complete documentation index, see [llms.txt](https://docs.awellhealth.com/llms.txt).



Navi grants access with a **JWT** that authorizes requests, inside a **session** that maintains
continuity; the two have different lifetimes.

A short JWT limits what a leaked token is worth, and the longer session keeps a stakeholder from being
interrupted mid-form.

## The JWT is much shorter-lived than the session [#the-jwt-is-much-shorter-lived-than-the-session]

Navi refreshes the JWT within the session, so nobody is asked to re-authenticate mid-form.

## The host backend requests the session; Navi issues the JWT [#the-host-backend-requests-the-session-navi-issues-the-jwt]

1. The host backend requests a session for a specific person.
2. Navi issues a short-lived JWT within that session.
3. The client uses the JWT for requests, and it's refreshed as needed while the session lives.

## Mint sessions server-side and keep JWT lifetimes short [#mint-sessions-server-side-and-keep-jwt-lifetimes-short]

* **Mint sessions server-side.** Session creation belongs on the backend, never in client code.
* **Keep JWT lifetimes short.** The default is short for a reason; lengthening it trades security for
  convenience.
* **Treat a session as one person's access**, not a shared resource.

## Next steps [#next-steps]

**Next:** [Branding and theming](/docs/embed-and-host/branding-and-theming).