Manage sessions

Each sign in opens its own session, so a user signed in on a laptop and a phone has two. Let users see them and end the ones they don’t recognize. Users and sessions explains what a session is.

List the user’s sessions

account.listSessions answers with the user’s active sessions, newest first, a page at a time. listSessionsAll walks every page for you.

JavaScript

for await (const session of orvano.account.listSessionsAll()) {
  console.log(session.userAgent, session.lastRefreshedAt, session.current)
}

Next.js

const { items } = await (await orvano()).account.listSessions()

Flutter

await for (final session in orvano.account.listSessionsAll()) {
  print('${session.userAgent} ${session.lastRefreshedAt} ${session.current}');
}

Each session has:

Field	What it holds
id	The session’s ID.
current	True for the session making this call: label it “This device”.
method	How it started: password, sign_up, magic_link, email_code, or recovery.
createdAt, lastRefreshedAt	When it started, and was last used.
userAgent, ipAddress	The device it started on. For a Next.js app, the user’s browser, not your server.
sdk	The SDK and version that started it.

End sessions

JavaScript

await orvano.account.deleteSession(sessionId) // one session
await orvano.account.deleteOtherSessions() // every session but this one
await orvano.account.deleteCurrentSession() // sign out here

Next.js

'use server'
const client = await orvano()
await client.account.deleteSession(sessionId)
await client.account.deleteOtherSessions()

Flutter

await orvano.account.deleteSession(sessionId);
await orvano.account.deleteOtherSessions();
await orvano.account.deleteCurrentSession();

account.deleteSession ends one session, account.deleteOtherSessions every one but the current. An ended session’s device is signed out at its next refresh. Its last access token keeps working with your own servers for up to 15 minutes, unless they use the online check.

From your server

With an API key, your support tools can do the same for any user: users.listSessions (users.read), users.deleteSession and users.deleteSessions (users.write). To sign a user out everywhere and keep them out, block them.