Security and sessions
How sign-in to MeerPartners is protected: tokens in httpOnly cookies, session lifetime, CSRF protection, signing out on all devices and protection of KYC data and payment details.
MeerPartners is built so that sign-in and sessions are secure by default — with no action on your part. Below is exactly how your account is protected and what you can do yourself.
How sign-in is protected
Sign-in is done via MeerID over the OIDC protocol — the platform doesn't have your passwords. After sign-in, the BFF layer (backend-for-frontend) puts the session tokens into secure cookies.
Tokens never reach JavaScript
Access tokens are stored in httpOnly cookies: they can't be read from page code (document.cookie). This is the key protection of the BFF pattern — even on an XSS attempt the token doesn't leak, because the frontend never sees it. All API calls go through the portal's server layer, not directly from the browser with the token in hand.
Session lifetime
| Token | Lifetime | Purpose |
|---|---|---|
| Access | 15 minutes | API access; refreshed automatically |
| Refresh | 30 days | Extending the session without signing in again |
In practice the session lives about a month: as long as you sign in at least once every 30 days, the access token is refreshed silently using the refresh token, and you don't need to log in again. If the refresh token has expired, the platform will ask you to sign in again ("Session expired. Please sign in again.").
CSRF protection
State-changing requests are protected against CSRF (cross-site request forgery): a third-party site can't perform an action on your behalf, even if you're logged in. The protection works automatically.
Signing out
The "Sign out" button is in the profile menu (the avatar in the header).
On sign-out, the platform ends your session and then redirects you to MeerID to close the single SSO session as well (RP-Initiated Logout). This matters on shared and public devices: without ending the SSO session, a repeated "silent" sign-in could go through without confirmation.
On someone else's device, sign out explicitly
If you signed in from someone else's or a shared computer, be sure to click "Sign out" rather than just closing the tab. That ends both the portal session and the MeerID SSO session.
Signing out on all devices
MeerPartners supports ending a session on all devices at once (logout-all) and back-channel logout — when sign-out is initiated on the MeerID side, the portal receives a notification and ends the associated session. This means: signing out of MeerID signs you out of MeerPartners across all linked sessions.
Data protection
Account security tips
- Protect your MeerID account — it's the only key to sign-in. Enable the protection methods available in MeerID (for example, Passkey).
- Sign out explicitly on someone else's and shared devices — with the "Sign out" button, not just by closing the tab.
- Don't share business API keys and tracking links with private
sub_idtags with outsiders. - Check the address of the sign-in page before authenticating — sign-in always goes through MeerID.
What isn't there yet
Two-factor authentication (2FA) isn't configured separately on the MeerPartners side — sign-in methods and their protection are managed in MeerID.