# session.pending: not signed in yet
Fires when a session exists but is not yet active, the typical case being a sign-in flow paused at a second factor or another verification step. The session will become active (session.created follows) or die.
## What to do on receipt
1. Record the pending session by `evt.data.id` if you track sign-in funnels. This is analytics data: "user started sign-in but has not finished."
2. Do NOT create a user session in your app, grant access, or send "welcome back" messaging. Nothing is authenticated yet.
3. If the pending session never converts, expire your funnel record after a sane window. Do not leave pending rows accumulating forever.
4. Return 200.
## The trap
Treating pending as signed in. Agents that count session.pending as a login inflate sign-in metrics and, worse, sometimes provision access for a user who never completed MFA. Pending is the opposite of a green light.
## Checklist
- Expect either `session.created` (they finished) or silence (they abandoned) after `session.pending`. There is no `session.pending_expired` event; the absence of a follow-up IS the abandonment signal.
- Do not send "finish signing in" nudges off this event unless you have explicit product approval. It is also the event that fires during legitimate slow MFA.
- Keep pending-session handling read-only. No writes to entitlements, no emails, no provisioning.