Manage sessions and devices

Every sign-in creates a session tied to that device and browser. You can see all of yours, end any of them, and rely on organization policies to clean up idle ones automatically.

Review your active sessions

1. Open Settings and go to the Security tab.

2. The Active Sessions list shows each device currently signed in, with its browser, IP address, and when it was last seen.

3. Select revoke on any session you do not recognize. That device is signed out on its next request.

Your current session is marked in the list and cannot be revoked from there; to end it along with everything else, use Logout All Devices.

Logout All Devices

The Session Management section’s Logout All Devices button ends every session at once, including the one you are using. Use it when you have signed in on a shared or lost device, or any time you want a clean slate.

It also disconnects apps and agents you signed in through OAuth, the connected AI clients (Claude, ChatGPT, and similar) and the desktop app. They reconnect with a single browser sign-in the next time you use them. Personal access tokens are not affected, revoke those separately under Settings, Developer.

Password changes and your sessions

Changing your password (also in Settings → Security) signs out every other device but keeps your current session alive, so you are not dumped to the login screen mid-change. This is the recommended response to a suspicious session: revoke it, then change your password.

Idle timeout, set by your organization

Owners and Admins can set a session policy in Organization Settings → Security & Compliance: an idle timeout (15, 30, 60, or 120 minutes, or off) and an optional cap on simultaneous sessions per user. Sessions idle past the timeout are signed out automatically. If you belong to several organizations, the strictest timeout among them applies to your account.

Tip

If you keep getting signed out while reading, it is probably an idle timeout from one of your organizations, not a bug. Any activity resets the clock.

Connected app token lifetime, set by your organization

Owners and Admins can also cap how long an OAuth-connected app or agent stays signed in, in Organization Settings, Security & Compliance, Session Policy, under Connected App Tokens. The default is 90 days, with 7, 14, 30, and 60-day options. A shorter lifetime just means connected clients reconnect (one browser sign-in) more often. The setting applies to new connections; existing connections keep the lifetime they were granted.

The idle timeout above deliberately does not apply to connected apps. An agent or integration should not be signed out for sitting idle the way a browser tab is, so connected apps are bounded by their token lifetime and by Logout All Devices instead.

Best practices

1. Review sessions monthly. Stale browser profiles + forgotten devices accumulate. A monthly scan + revoke surfaces what shouldn’t be there.
2. Logout All Devices on lost device. Faster than per-session revocation and covers everything. Also fires on password change.
3. Set idle timeout to 30-60 minutes for orgs handling sensitive data. Shorter = more friction; longer = more risk. Balance.
4. Pair with 2FA. Sessions + 2FA = defense in depth. See Enforce two-factor authentication.
5. Cap simultaneous sessions for privileged roles. Owner/Admin accounts on 2 devices max; quietly evicts oldest on a 3rd device.

Troubleshooting / common pitfalls

• Session list shows unknown IP. Mobile carrier or VPN. Verify with user before revoking; could be legitimate.
• Revoked session keeps making requests. Cache; revocation takes effect on next request. Wait a few seconds.
• Logout All Devices signed out current session. By design. Sign back in.
• Idle timeout kicking in fast. Strictest org policy wins. Check which org has the shortest timeout.
• Two sessions from same machine. Different browsers or private window. Normal; revoke either.

How this combines with other features

• Sessions + 2FA. 2FA enforced = session creation requires 2FA. See Enforce two-factor authentication.
• Sessions + Password change. Password change signs out other sessions, keeps current alive.
• Sessions + Audit log. Sign-ins
  • revocations write to audit log.
• Sessions + API tokens. Tokens independent; have own revocation. See Create API tokens.

Coming from another tool

Tool	Mapping
Google Workspace session management	Direct concept
Microsoft 365 sign-in management	Direct
Slack workspace sessions	Direct
Custom session management	Standard pattern
SSO session policies	IdP-level + Onplana-level both apply

FAQs

I see a session from a location I do not recognize. What should I do? Revoke it immediately, then change your password (which signs out all other devices), and check that two-factor authentication is on. See Enforce two-factor authentication.

Does revoking sessions affect my API tokens? No. Personal access tokens are independent of browser sessions and have their own revocation. Manage them under Settings → Developer, see Create API tokens.

What does the per-user session cap do? When an organization sets a maximum number of sessions, signing in on a new device beyond the cap quietly ends your oldest session.

Why does the same login appear twice? Each browser profile and each device counts separately. Two entries from the same machine usually means two browsers, or a normal and a private window.

Can I label sessions for clarity? Not natively today. Session shows browser + IP + last-seen as the identification.

Does mobile app count as a separate session? Yes — each client (web, iOS, Android) is a separate session.

Are sessions encrypted in transit? Yes — Onplana uses TLS for all session-bearing requests.

Related

• Enforce two-factor authentication — defense in depth
• Create API tokens — token-based auth
• Read audit logs — sign-in history