When implementing OneAll on a backend server, what helped me was treating it as a clean auth layer: validate the token server-side, map it to your user model, then keep session handling fully on your API. This avoids odd login freezes and makes scal…