Sessions and devices
See where you are signed in, and remotely sign out.
A session is a sign-in on one browser or app. Dalea tracks every active session on your account and lets you revoke any of them remotely. This page is how you stay on top of which devices are signed in as you.
Where to find your sessions
Settings → Security → Active Sessions.
You'll see a list of every session that has not yet expired. Each row shows:
| Field | What it means |
|---|---|
| Device | "Chrome on macOS", useful for spotting unfamiliar devices. |
| IP address | Approximate origin. Mobile carriers can show a different region than where your phone actually is. |
| Last active | When this session last made a request. |
| This device | Badge on your current session. |
The row carries no sign-in method: a session does not record whether it started from a password, an OAuth provider or a passkey.
Signing out sessions
Click Revoke on a row and confirm. The session is invalidated immediately, and the next request from that browser lands on the sign-in page.
Below the list, Sign out all other devices revokes everything except the
session you are using. It asks for a reason for change before it runs, and the
reason is recorded in the audit log as auth.all_sessions_revoked.
Your current session has no Revoke button. To end it, use the regular Sign out option in the user menu.
When to be vigilant
Three flags worth watching:
- A device you don't recognise. Even if it shares your geography, an unknown browser fingerprint is worth investigating. Revoke and rotate your password (or remove the rogue passkey).
- A geography that doesn't match your travel. A session active from a city you weren't in is a hard signal. Revoke immediately.
- A session active long after you forgot it. If you signed in to demo Dalea on a colleague's machine three months ago, that session might still be there. Spring-clean the list every quarter.
Auto-expiry
Sessions don't last forever even if you never click revoke:
- Seven-day lifetime. A session expires seven days after it was issued. While you keep using it, Dalea extends that expiry, at most once a day, so an everyday browser stays signed in and an idle one drops out after a week.
- Sensitive-action elevation. Adding or removing a passkey needs a fresh session, meaning you authenticated within the last five minutes; if yours is older, Dalea asks you to re-authenticate and then retries the action for you. Changing your password asks for your current password. Viewing the audit trail needs neither, though exporting it requires an e-signature.
API keys vs sessions
Sessions are for browsers. For programmatic access, meaning scripts, Python clients and server-to-server integrations, use API keys instead. They live under Settings → Developer, not under Security, and revoking a session doesn't touch them.
See the Developers section for the full picture.