View and manage your active login sessions across all devices where you're signed in to Ottili ONE.
Why Manage Sessions?
- Security*: Sign out of devices you no longer use or have lost
- Privacy*: Ensure only your devices have access to your account
- Awareness*: See where and when your account is being accessed
- Control*: Revoke access from suspicious or unauthorized sessions
Viewing Active Sessions
Step 1: Navigate to Sessions
1. Sign in to your Ottili ONE account
2. Go to [auth.ottili.one/sessions](https://auth.ottili.one/sessions)
3. Review your active sessions
What You'll See
Each session shows:
- Device*: Browser and operating system (e.g., "Chrome on macOS")
- Location*: Approximate location based on IP address (e.g., "Berlin, Germany")
- IP Address*: The IP address used for this session
- Last Active*: When this session was last used
- Current*: Indicates the session you're currently using
Managing Sessions
Sign Out of a Single Session
1. Go to [auth.ottili.one/sessions](https://auth.ottili.one/sessions)
2. Find the session you want to end
3. Click "Sign out" next to that session
4. Confirm the action
Note*: You cannot sign out of your current session this way. Use the "Sign out" button in the navigation instead.
Sign Out of All Other Sessions
1. Go to [auth.ottili.one/sessions](https://auth.ottili.one/sessions)
2. Click "Sign out all other sessions"
3. Confirm the action
This signs you out of all devices except the one you're currently using.
Sign Out Everywhere
To sign out of all sessions including your current one:
1. Click "Sign out" in the navigation menu
2. Or go to [auth.ottili.one/logout](https://auth.ottili.one/logout)
Understanding Session Information
Device Information
Sessions show the browser and operating system:
- Chrome on macOS*: Google Chrome browser on Mac
- Safari on iOS*: Safari browser on iPhone/iPad
- Firefox on Windows*: Firefox browser on Windows PC
- Mobile Safari*: Safari on iOS device
Location Information
Location is approximate and based on IP address geolocation:
- May show city/region level, not exact address
- VPN users may see the VPN server location
- Mobile users may see different locations as they move
IP Address
The IP address used when the session was created or last refreshed:
- May change if you move locations or switch networks
- VPN users will see the VPN server IP
- Not a reliable way to identify a specific device
Last Active
Shows when the session was last used to access Ottili ONE:
- "Just now" = active in the last minute
- "5 minutes ago" = active 5 minutes ago
- "2 hours ago" = active 2 hours ago
- "Yesterday" = active yesterday
Session Security
When to Review Sessions
Review your active sessions regularly:
- Monthly*: Check for unfamiliar devices or locations
- After travel*: Verify sessions from travel locations are yours
- After sharing devices*: Sign out of shared/public computers
- After security incidents*: Check for unauthorized access
Signs of Unauthorized Access
Watch for these warning signs:
- Unknown devices*: Browsers/OS you don't use
- Unknown locations*: Cities/countries you haven't visited
- Unexpected times*: Activity when you were asleep/away
- Multiple sessions*: More sessions than devices you own
What to Do If You See Suspicious Activity
1. Sign out the suspicious session* immediately
2. Change your password* at [auth.ottili.one/change-password](https://auth.ottili.one/change-password)
3. Enable 2FA* if not already enabled
4. Review recent activity* in your account
5. Contact support* at support@ottili.one if you suspect a breach
Session Lifecycle
How Sessions Work
1. Sign in*: Creates a new session with access and refresh tokens
2. Access token*: Short-lived (15 minutes), used for API requests
3. Refresh token*: Long-lived (30 days), used to get new access tokens
4. Automatic refresh*: Access tokens refresh automatically when needed
5. Session expiry*: Sessions expire after 30 days of inactivity or when signed out
Session Expiry
Sessions expire when:
- Inactivity*: No activity for 30 days
- Absolute timeout*: 90 days from creation (even with activity)
- Manual sign out*: You sign out of the session
- Password change*: All sessions are revoked when you change your password
- Account lock*: Account is locked due to security concerns
Automatic Token Refresh
You don't need to manually refresh sessions:
- Access tokens refresh automatically when they expire
- Refresh tokens rotate on each use for security
- You stay signed in as long as you use your account regularly
Best Practices
1. Use Strong Authentication
- Enable 2FA or passkeys for all sessions
- Use unique, strong passwords
- Don't share your credentials
2. Sign Out of Shared Devices
Always sign out when using:
- Public computers (libraries, internet cafes)
- Shared devices (family computers, work devices)
- Borrowed devices (friend's phone/laptop)
3. Review Sessions Regularly
Check your sessions:
- Monthly for routine security
- After traveling or using new devices
- If you notice unusual account behavior
4. Use Trusted Devices Only
Avoid signing in on:
- Untrusted or compromised devices
- Devices with outdated software
- Devices with malware or keyloggers
5. Secure Your Devices
Protect devices with active sessions:
- Use device PIN/password/biometrics
- Enable device encryption
- Keep operating systems updated
- Install security updates promptly
Troubleshooting
"Session expired" Message
Cause*: Your session has expired due to inactivity or timeout.
Solution*: Sign in again at [auth.ottili.one/login](https://auth.ottili.one/login)
"Too many sessions" Warning
Cause*: You have more active sessions than expected.
Solution*:
1. Review all sessions at [auth.ottili.one/sessions](https://auth.ottili.one/sessions)
2. Sign out of sessions you don't recognize
3. Change your password if you see suspicious sessions
Session Not Showing Current Device
Cause*: Current session may not be marked correctly.
Solution*:
1. Refresh the page
2. Sign out and sign in again
3. The new session will be marked as "Current"
Location Shows Wrong City/Country
Cause*: IP geolocation is approximate and may be inaccurate.
Solution*:
- This is normal for VPN users or mobile networks
- Focus on device/browser information instead
- If the device is unfamiliar, sign out that session
Frequently Asked Questions
How many sessions can I have?
There's no hard limit, but we recommend keeping sessions only on devices you actively use. Most users have 2-5 active sessions (phone, laptop, tablet).
Do sessions expire automatically?
Yes! Sessions expire after:
- 30 days of inactivity
- 90 days from creation (even with activity)
- When you change your password
- When you manually sign out
Can I see session history (past sessions)?
No, only active sessions are shown. Once a session expires or is revoked, it's removed from the list.
Will signing out of a session delete my data?
No! Signing out only ends the authentication session. Your data (projects, files, settings) remains in your account.
Can someone use my session if they steal my device?
If your device is protected with a PIN/password/biometric, they cannot access your sessions. Always secure your devices.
Why do I see multiple sessions from the same device?
This can happen if:
- You signed in from different browsers on the same device
- You cleared cookies and signed in again
- You used incognito/private browsing mode
Can I name my sessions?
Not currently. Sessions are identified by device/browser information. You can add a note to help identify them (coming soon).
Related Articles
- [Two-Factor Authentication](/docs/auth-two-factor-authentication) - Add an extra layer of security
- [Passkeys](/docs/auth-passkeys) - Secure, passwordless authentication
- [Recovery Codes](/docs/auth-recovery-codes) - Account recovery when you lose access
Need Help?
If you're having trouble with sessions:
- Check our [troubleshooting guide](#troubleshooting) above
- Visit our [Help Center](https://help.ottili.one)
- Contact support at support@ottili.one
Was this article helpful?