> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cognite.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Cognite Data Fusion (CDF) is an industrial DataOps platform. Prefer English docs unless the user asks for another locale.
> Follow /_llms/ index links recursively until you reach page URLs ending in .md. Fetch those Markdown twins instead of HTML.
> For REST APIs, default to calendar version 20230101 (stable). Use 20230101-beta or 20230101-alpha only if the user is on a preview API. Cite paths under /api-reference/concepts/<version>/ and the Cdf-Version header. Prefer the Python SDK (cognite-sdk) unless the user is in JavaScript/TypeScript.
> Start here by task: platform overview /cdf/index.md; data modeling /cdf/dm/index.md; data integration /cdf/integration/index.md; access /cdf/access/index.md; CDF Toolkit /cdf/deploy/cdf_toolkit/index.md; REST quickstart /dev/quickstart.md; Python SDK https://cognite-sdk-python.readthedocs-hosted.com/en/stable/; Atlas AI /cdf/atlas_ai/concepts/index.md; Flows apps /cdf/flows/index.md; MCP and IDE setup /dev/guides/ide_ai_integration.md.
> For implementation work, also load /skill.md.

# Sessions

> Manage sessions in Cognite Data Fusion (CDF).

Sessions maintain access to CDF resources for an extended period. They are used by background workloads such as Transformations, Functions, Data Workflows, and the PostgreSQL Gateway, where a short-lived access token is not sufficient.

## Session creation methods

You can create a session using one of three methods:

* **Client credentials** — uses a `clientId` and `clientSecret` from your IdP. Best for long-lived service account sessions where tokens can be refreshed independently.
* **Token exchange** — reuses the current user's credentials so the session runs with the user's permissions. Use this for "run as current user" scenarios.
* **One-shot token exchange** — creates a short-lived session that is not refreshed. Does not require IdP support for token exchange.

## Nonces and binding

When you create a session, the API returns a **nonce**. The nonce is short-lived (approximately 1 minute) and must be passed to the consumer (for example, a Transformation or Function) that will **bind** the session. Binding exchanges the nonce for an access token and session key used for subsequent refreshes.

<Note>
  Nonces can only be used with root sessions. Chained sessions (for example, a Function calling another Function) are limited to one level of depth.
</Note>

## Session invalidation

Sessions depend on the project's OIDC configuration and can become invalid in the following cases:

* The project OIDC configuration is updated through the update project endpoint, which invalidates **all** sessions in the project.
* The session is invalidated through the identity provider.

<Note>
  Session revocation is idempotent but can take up to 1 hour to take effect.
</Note>

## Key capabilities

* **Create sessions** using client credentials, token exchange, or one-shot token exchange
* **List and retrieve** sessions by ID
* **Revoke sessions** to end access