diff --git a/ahserver/auth_api.py b/ahserver/auth_api.py
index 1083d84..8fc2f61 100755
--- a/ahserver/auth_api.py
+++ b/ahserver/auth_api.py
@@ -13,11 +13,11 @@ from appPublic.app_logger import AppLogger
 class AuthAPI(AppLogger):
 	def __init__(self):
 		super().__init__()
+		self.conf = getConfig()
 
 	def getPrivateKey(self):
 		if not hasattr(self,'rsaEngine'):
 			self.rsaEngine = RSA()
-			self.conf = getConfig()
 			fname = self.conf.website.rsakey.privatekey
 			self.privatekey = self.rsaEngine.read_privatekey(fname)
 		return self.privatekey
@@ -34,8 +34,15 @@ class AuthAPI(AppLogger):
 		# Create an auth ticket mechanism that expires after 1 minute (60
 		# seconds), and has a randomly generated secret. Also includes the
 		# optional inclusion of the users IP address in the hash
-		policy = auth.SessionTktAuthentication(urandom(32), 120,
-												reissue_time=100,
+		session_max_time = 120
+		session_reissue_time = 30
+		if self.conf.website.session_max_time:
+			session_max_time = self.conf.website.session_max_time
+		if self.conf.website.session_reissue_time:
+			session_reissue_time = self.conf.website.session_reissue_time
+		
+		policy = auth.SessionTktAuthentication(urandom(32), session_max_time,
+												reissue_time=30,
 											   include_ip=True)
 
 		# setup aiohttp_auth.auth middleware in aiohttp fashion