I would recommend that you make a JWT based session (using Session.createJWT function) that we have. Then on sign in, you can get the JWT's payload and merge that with the session's access token payload.