Changelog

API changes, breaking changes, and notable updates. Dates are in YYYY-MM-DD format.

---

2026-07-31

Access Token — Expiry reduced to 15 minutes

Type: Breaking change (if your integration assumes a 1-hour token lifetime)

The accessToken returned by POST /v1/users/login now expires after 15 minutes, down from 1 hour. This aligns with security best practices for short-lived JWTs.

What to check in your integration:

• If you store the accessToken and reuse it across multiple calls, add expiry handling. The exp claim in the JWT payload gives you the exact expiry timestamp — check it before each API call and refresh proactively.
• If you already handle 401 Unauthorized by re-authenticating the user, no change is needed — this path already covers token expiry.

Refresh without re-login:

Call GET /v1/users/refresh-token with the Authorization: Bearer <expiredOrFreshAccessToken> header to get a new access token without requiring the user to re-enter their email.

---

JWT Claims — Updated structure

Type: Additive (new claims added)

The accessToken JWT payload now includes additional claims for traceability and security:

Claim	Type	Description
sub	String	Unique user identifier (ULID)
aud	String	Your application's Client ID — unique per API key
iss	String	Token issuer: https://iam.onmeta.io/onmeta
iat	Integer	Issued-at time (Unix timestamp)
exp	Integer	Expiration time (Unix timestamp)
jti	String	Unique JWT identifier (UUID/ULID) — for request tracing and replay prevention
tenant_id	String	Internal Onmeta tenant identifier

Example decoded payload:

{
  "sub": "01KXXXXXXXXX",
  "tenant_id": "01XXXXXXXX",
  "aud": "01XXXXXXXXX",
  "iss": "https://iam.onmeta.io/onmeta",
  "iat": 1785742733,
  "exp": 1785743633,
  "jti": "01XXXXXXXXX"
}

---