---
url: https://docs.youcan.shop/changelog/store-admin-session-issuer.md
---

Session tokens are issued by the store admin, and the launch URL of an embedded app has the store admin in `host`.

***

# Store admin in session tokens and launch URLs

* The `iss` claim of a session token is the store admin URL, `https://<slug>.youcan.store/admin`, instead of `https://seller-area.youcan.shop/admin`.
* The `dest` claim is the store's YouCan URL, `https://<slug>.youcan.store`, with the scheme. A custom domain of the store is never used in `iss` or `dest`.
* Check that `iss` is `dest` followed by `/admin`.
* The launch URL of an embedded app has a `host` param with the base64-encoded store admin (`<slug>.youcan.store/admin`). The `host` param is included in the HMAC.
* When your app is loaded outside the Seller Area, redirect to `https://<decoded host>/apps/<your app handle>/app`.
* See [JWT Payload](/apps/embedded_app/auth#jwt-payload).