Session administration

Every signed-in user has one session per device. There are two ways to manage them — from your backend with your secret key (support tooling, security response), and from the user’s own account UI (self-service).

From your backend

All three endpoints take your secret key and are scoped to its environment; a userId from another environment returns 403, never a 404 that would confirm the id exists elsewhere.

GET    /api/server/v1/users/{userId}/sessions              # active sessions, most recently used first
DELETE /api/server/v1/users/{userId}/sessions              # revoke every session → 204
DELETE /api/server/v1/users/{userId}/sessions/{sessionId}  # revoke one → 204

curl https://api.toriiauth.eu/api/server/v1/users/$USER_ID/sessions \
  -H "Authorization: Bearer $TORII_SECRET_KEY"

Each session carries:

Field	Notes
`id`	Use it to revoke this one session.
`userAgent`	The raw User-Agent string as sent. Parse it yourself if you want a device name.
`ipAddress`	The client IP recorded at sign-in.
`createdAt` / `lastUsedAt` / `expiresAt`	`lastUsedAt` advances on each token refresh, so it is the freshest activity signal.
`activeOrganizationId`	The organization active on this session, if any.
`impersonatedBy`	Set when the session was created by impersonation; the operator behind it.

Both revocations are idempotent — revoking an already-revoked or expired session still returns 204, so a retry is always safe. Revocation takes effect on the next token refresh at the latest, which is within about a minute given the short access-token lifetime.

Every revocation is written to the audit log with your secret key recorded as the actor.

Letting users manage their own devices

<UserProfile>’s Security section already lists the user’s devices and lets them sign out of one or of all others, with the current session marked. Nothing to wire up.

To build your own, use useSessions():

const { sessions, revokeSession, revokeAllOtherSessions } = useSessions();

Behind it are the self-service endpoints, which act on the caller’s own user and need only a session (no secret key):

GET    /_torii/users/me/sessions
DELETE /_torii/users/me/sessions/{sessionId}
DELETE /_torii/users/me/sessions              # every OTHER session; the caller stays signed in

Session lifetime — how long a session survives inactivity, and the absolute cap: Authentication & session configuration.
Banning a user revokes all of their sessions as a side effect: POST /api/server/v1/users/{userId}/ban.
Signing out one device from your own app is signOut() on useAuth(), not a revocation call.

Session administration

From your backend

Letting users manage their own devices

Related