---
title: "Sessions"
description: "How the browser SDK cuts visits into sessions, how to turn sessions off, and how to use your own session ids."
canonical: "https://www.togohq.ai/docs/concepts/sessions"
applies_to: "@togohq/sdk-browser 1.x"
updated: "2026-11-05T00:00:00Z"
---

# Sessions

How the browser SDK cuts visits into sessions, how to turn sessions off, and how to use your own session ids.

## The SDK decides the session

The browser SDK starts a session at the first `track()` and ends it after
`sessionTimeoutSeconds` with no events — **30 minutes** by default — or after **24 hours**, whichever
comes first. Togo stores the session id each event carries and never re-cuts sessions on the
server.

- **Not at `init()`.** Browsers prerender pages nobody ever sees, so a session that started at
  `init()` would count visits with no person in them.
- **The 24-hour cap is not configurable.** Without it, a tab left open with a heartbeat would hold
  one session forever.
- **The id is opaque and random.** It does not encode a start time, so do not parse one out of it.

## Change the timeout, or turn sessions off

```ts
init({ writeKey, sessionTimeoutSeconds: 600 }); // 10-minute idle window
init({ writeKey, sessionTimeoutSeconds: 0 }); // no sessions at all
```

**`sessionTimeoutSeconds: 0` (or any value `<= 0`) disables sessions** and sends no session id. It
does not mean "expire immediately", which would make every event its own session. If the value
comes from an environment variable, check it is really what you meant: a `0` from a missing
variable turns sessions off.

The value is in **seconds**. Anything above `86400` logs an error, because the 24-hour cap makes it
the same as `86400` and it is most likely a millisecond number — `1800000` for 30 minutes. Code
written for an earlier version that passes `sessionTimeoutMs` in milliseconds keeps working.

## Use your own session ids

If your app already has a session concept, pass it and it wins:

```ts
init({ writeKey, sessionId: mySession.id });
```

The SDK then keeps no session state of its own. A custom id must be 1–128 characters of letters,
digits, `_`, `.`, `:`, `@`, `+`, `%` or `-`; anything else is refused with
[`session_id_invalid`](/docs/reference/event-diagnostics#session_id_invalid).

## Server events

The [server SDK](/docs/node) has no sessions of its own. To attach a server event to the visit it
belongs to, forward the browser's `getSessionId()` as `sessionId` on the call.

## In reports

Events without a session id — server events that did not forward one, or a browser with sessions
turned off — are left out of session metrics rather than counted as one big session.