Automatic Sign-Out And Activity Integration

Reuse The Shared Adapters

Internal TIB applications should install the shared adapters. External tenants must meet the same contract and tests, using the provided adapters or a compatible implementation.

Server-Enforced Automatic Sign-Out

The central member preference sets inactivity to 5, 10, 15, 20, 25 or 30 minutes; default 10. Browser-session mode still has a 30-minute inactivity cap. Show the branded two-minute warning with Stay Signed In and Sign Out. Background polling must not extend access. Enforce checks on every protected backend route; reject expired/revoked sessions, clear the local session and return to the app’s signed-out page. Fail closed when authority is unavailable. Browser-close detection is not guaranteed.

Bind The Correct Subject

After the existing SSO exchange succeeds, bind the receiving app’s authenticated subject to its current TIB grant through POST /api/hub/tenant-runtime/link using the member’s verified TIB authorization. Supply appId; for business activity also supply businessId and businessConsent: true. TIB validates ownership and the active app connection and returns an opaque app-scoped subject. Keep that mapping and a fresh random session ID in the app’s server session. Never accept a caller-selected TIB member ID.

Session And Activity Endpoints

The server-only setup credential authorizes POST /api/tenant-runtime/session and POST /api/tenant-runtime/activity. Session actions are start, check, activity and logout. Only real member interaction may call activity. The public browser adapter calls your own authenticated same-origin handlers; it must never receive the TIB service credential. Preserve CSRF protection and HttpOnly local sessions.

Activity requires subject, stable eventId, kind and occurredAt in milliseconds. Kinds: sign_in, sign_out, wallet_transaction. A wallet event also requires a non-sensitive transaction reference. Session start/logout automatically report login/sign-out. Transaction reports are application-reported activity, not independent proof of settlement. Do not send card numbers, banking credentials, documents or balances.

Member And Business Ledgers

Personal events appear in the member Activity ledger. Business events appear only in the authorized business Activity ledger. Labels include USA Account Login and Wallet Transaction In USA. Stable event IDs prevent duplicate entries. Existing USA reporting remains compatible; apps should use one login-reporting path to avoid duplicate reports.

Finalize Setup

In the protected tenant review queue, complete profile binding and evidence review, then press Finalize Setup. It registers approved configuration, issues or reuses the TIB application key, prepares session/activity assets, checks SSO readiness and prepares requested plan connectors. Download Setup Assets to install the server configuration. Retry Finalize Setup after resolving its per-capability blockers.

The button cannot install code in another project without its deployment adapter, invent processor credentials or bypass missing tests. SSO activates only after adapter/configuration checks and verified sign-in, activity, automatic-sign-out and revocation tests. Payment, bank, wallet and scheduling services remain blocked until their provider integrations and acceptance are ready. Plans remain pending until configured.

Required Tests

Test inactivity expiry at every supported setting, warning actions, background polling, tab restore, denied/revoked keys and grants, exact app/member/business isolation, event deduplication and non-sensitive transaction reporting. Include the results under the Automatic Sign-Out And Activity Reporting security control. Existing sign-in, callback, state and PKCE sequences are preserved.