Sessions
Understand session expiry, device limits, and signing out.
A session keeps one device signed in. It ends after 30 days without activity or 90 days after creation, whichever comes first. Signing out ends the current session immediately and leaves other devices signed in.
Session limits
Limit | Behavior |
|---|---|
Inactivity | Each use restarts the 30-day inactivity window. |
Absolute age | Activity cannot extend a session beyond 90 days; sign in again. |
Active sessions | Up to 10. Creating an eleventh ends the oldest session. |
Browser credential | Renewed in the background roughly hourly while the session remains valid. |
Hourly renewal is not a new session and does not reset its absolute age.
What is recorded
Each session records a device fingerprint, readable device name, sign-in IP address, creation time, and last-activity time. Revoking a session retains its record for auditing.
Suspending or deleting an account stops its authentication paths, including existing authenticated requests.
What signing out does not revoke
Separate access | What to manage |
|---|---|
Another browser session | That device’s session. |
OAuth application access | The application’s authorization credentials. |
API key | Revoke the key itself. |
Trusted device | Remove it under Account → Security. |
A trusted device skips a second-factor challenge for its own 30-day period. It is not a session. Signing out does not remove that trust; two-factor settings control it.