Manage sessions and devices

Every sign-in creates a session tied to that device and browser. You can see all of yours, end any of them, and rely on organization policies to clean up idle ones automatically.

Review your active sessions

1. Open Settings and go to the Security tab.

2. The Active Sessions list shows each device currently signed in, with its browser, IP address, and when it was last seen.

3. Select revoke on any session you do not recognize. That device is signed out on its next request.

Your current session is marked in the list and cannot be revoked from there; to end it along with everything else, use Logout All Devices.

Logout All Devices

The Session Management section’s Logout All Devices button ends every session at once, including the one you are using. Use it when you have signed in on a shared or lost device, or any time you want a clean slate.

It also disconnects apps and agents you signed in through OAuth, the connected AI clients (Claude, ChatGPT, and similar) and the desktop app. They reconnect with a single browser sign-in the next time you use them. Personal access tokens are not affected, revoke those separately under Settings, Developer.

Password changes and your sessions

Changing your password (also in Settings → Security) signs out every other device but keeps your current session alive, so you are not dumped to the sign-in screen mid-change. This is the recommended response to a suspicious session: revoke it, then change your password.

Idle timeout, set by your organization

Owners and Admins set this in Organization Settings → Security & Compliance, in the Sign-in section of the Controls sub-tab: Sign out after no activity for (15, 30 or 60 minutes, 2 hours, or Disabled) and Sign people out after, the longest a sign-in lasts even while someone is working. Both save with the section’s Save changes button. Sessions idle past the timeout are signed out automatically.

After shortening these, Sign everyone out in the same section ends every sign-in now, yours included, so older sign-ins do not outlast the new rule. It asks first. If you belong to several organizations, the strictest timeout among them applies to your account.

Tip

If you keep getting signed out while reading, it is probably an idle timeout from one of your organizations, not a bug. Any activity resets the clock.

Connected app token lifetime, set by your organization

Owners and Admins can also cap how long an OAuth-connected app or agent stays signed in, in Organization Settings, Security & Compliance, Sign-in section, under Connected apps stay signed in for. The default is 90 days, with 7, 14, 30, and 60-day options. A shorter lifetime just means connected clients reconnect (one browser sign-in) more often. The setting applies to new connections; existing connections keep the lifetime they were granted.

The idle timeout above deliberately does not apply to connected apps. An agent or integration should not be signed out for sitting idle the way a browser tab is, so connected apps are bounded by their token lifetime and by Logout All Devices instead.

Best practices

1. Review sessions monthly. Stale browser profiles + forgotten devices accumulate. A monthly scan + revoke surfaces what shouldn’t be there.
2. Logout All Devices on lost device. Faster than per-session revocation and covers everything. Also fires on password change.
3. Set idle timeout to 30-60 minutes for organizations handling sensitive data. Shorter = more friction; longer = more risk. Balance.
4. Pair with 2FA. Sessions + 2FA = defense in depth. See Enforce two-factor authentication.
5. Cap simultaneous sessions for privileged roles. Owner/Admin accounts on 2 devices max; quietly evicts oldest on a 3rd device.

Troubleshooting / common pitfalls

• Session list shows unknown IP. Mobile carrier or VPN. Verify with user before revoking; could be legitimate.
• Revoked session keeps making requests. Cache; revocation takes effect on next request. Wait a few seconds.
• Logout All Devices signed out current session. By design. Sign back in.
• Idle timeout kicking in fast. Strictest organization policy wins. Check which organization has the shortest timeout.
• Two sessions from same machine. Different browsers or private window. Normal; revoke either.

How this combines with other features

• Sessions + 2FA. 2FA enforced = session creation requires 2FA. See Enforce two-factor authentication.
• Sessions + Password change. Password change signs out other sessions, keeps current alive.
• Sessions + Audit log. Sign-ins
  • revocations write to audit log.
• Sessions + API tokens. Tokens independent; have own revocation. See Create API tokens.

Coming from another tool

Tool	Mapping
Google Workspace session management	Direct concept
Microsoft 365 sign-in management	Direct
Slack workspace sessions	Direct
Custom session management	Standard pattern
SSO session policies	IdP-level + Onplana-level both apply

FAQs

I see a session from a location I do not recognize. What should I do? Revoke it immediately, then change your password (which signs out all other devices), and check that two-factor authentication is on. See Enforce two-factor authentication.

Does revoking sessions affect my API tokens? No. Personal access tokens are independent of browser sessions and have their own revocation. Manage them under Settings → Developer, see Create API tokens.

What does the per-user session cap do? When an organization sets a maximum number of sessions, signing in on a new device beyond the cap quietly ends your oldest session.

Why does the same login appear twice? Each browser profile and each device counts separately. Two entries from the same machine usually means two browsers, or a normal and a private window.

Can I label sessions for clarity? Not natively today. Session shows browser + IP + last-seen as the identification.

Does mobile app count as a separate session? Each web browser session counts separately, but the Onplana Tasks phone and desktop companion apps connect through OAuth as connected apps, not browser sessions, so they never appear in this Active Sessions list. Logout All Devices disconnects them too, and their token lifetime is governed by the Connected App Tokens policy, not the session settings on this page.

Are sessions encrypted in transit? Yes, Onplana uses TLS for all session-bearing requests.

Related

• Enforce two-factor authentication, defense in depth
• Create API tokens, token-based auth
• Read audit logs, sign-in history