Help Center

Docs

Active Sessions

See every device signed in to your account, revoke the ones you don't recognize, and report suspicious sign-ins

Overview

The Active sessions section lists every device currently signed in to your account.

On Settings > Security, the Active sessions section shows one row per device or browser you are signed in on. The total count sits at the top of the card so you can spot an unexpected extra session at a glance. If you travel, work on multiple machines, or let a coworker borrow your laptop, this is where you check what is still logged in as you.

What Each Row Shows

Every session row packs the key facts on one line, with more detail on expand.

  • Device type icon — A monitor or phone icon, based on the user agent.
  • Device label — Browser and operating system, e.g. "Chrome on macOS".
  • This device badge — Green badge on the row for the device you are currently using.
  • Risk badge — Amber for "new country", "new network", or "new device"; red for "impossible travel". Present only when the sign-in looked unusual.
  • Location & last active — City and country code when available, plus a relative timestamp like "23m ago".
  • Expand (chevron) — Reveals the full IP address, exact created and last-active timestamps, the expiry date, and the user agent string.
  • Revoke button — Shown for every session except the one you are currently on.

Revoking a Single Session

Sign out one device without affecting the others.

1

Open Settings > Security

Scroll to the Active sessions card.
2

Find the session

Use the device label and location to identify the one you want to sign out. Expand the row if you need IP or exact time to be sure.
3

Click Revoke

The Revoke button sits on the right of the row. It is not shown on your current session.
4

Confirm in the dialog

The dialog reminds you the device will be signed out. Confirm to proceed.

Sign Out All Other Sessions

Useful when you suspect someone else is signed in or when you are about to travel.

The Sign out other sessions button sits at the top right of the Active sessions card. It revokes every session except the one you are currently using, so you stay signed in on the device in your hand. Because this change weakens nothing about your account but does affect other devices, the app asks you to step-up reauth before it runs.

Good hygiene before a trip
Running Sign out other sessions right before you travel means a lost phone or laptop cannot be used to reach your account later. You will sign back in from the new location as needed.

What Revocation Actually Does

How quickly a revoked device is signed out.

Revoking a session marks it as invalid on the server. The revoked device is signed out within about 30 seconds the next time the app checks in. This 30-second window is the absolute upper bound — most active tabs notice the revoke on their next request, which is usually much faster.

Already-rendered pages are still revoked
Even if the revoked device had a page open when you hit Revoke, the next interaction that touches the server will fail and bounce them to the sign-in page. You do not need them to close the tab.

Reporting a Suspicious Sign-In ("This wasn't me")

The nuclear option for when you see a sign-in you did not make.

The Recent activitysection below Active sessions shows every sign-in event. When a successful sign-in carries a risk flag — new country, new network, new device, or impossible travel — a red This wasn't me button appears on that row.

1

Open Settings > Security and scroll to Recent activity

Find the sign-in you did not make. Risk-flagged successful sign-ins show an amber or red badge next to the event label.
2

Click "This wasn't me"

The button is red and says "This wasn't me". It is only shown on sign-ins the system already flagged as unusual.
3

Confirm

The confirmation dialog explains what happens: the related session is revoked, all your devices are signed out, and your admin is notified so you can change your password from a trusted device.
Change your password from a trusted device
After reporting, open Settings > Security from a device you trust and change your password. If you do not have one (OAuth-only accounts), set one from the Password card so the attacker cannot simply sign back in.

Session Detail Retention

How long session metadata sticks around.

Active sessions only show devices that are currently valid. Expired or revoked sessions drop off the list automatically. For a historical view of sign-ins, MFA events, and revocations over the last 30 days, use the Recent activity section below.