Sessions

A session is one signed-in browser or device. The client keeps it for you, refreshes it before it expires and uses it for every request. This page covers how long sessions last, how many a person may have, and what you do with them in your app.

Sessions page — Users & auth → Sessions: active sessions, with Session settings.

In Studio

Users & auth → Security → Sessions. Access tokens are short and refresh quietly. A refresh token that is used twice ends the whole session, on the assumption it was stolen.

Session settings

Setting	Meaning	Key	Default
Access token lifetime	Seconds, at least 60. How long one access token is valid	`access_ttl`	900 (15 minutes)
Refresh token lifetime	Seconds, at least 3600. How long someone stays signed in without activity	`refresh_ttl`	2,592,000 (30 days)
Sessions per user	0 is unlimited. Over the limit, the oldest session ends when a new one starts	`max_sessions`	0

Active sessions

A table of live sessions (person, method, device, last active). From there an administrator can end a session.

Choosing lifetimes

Access token: keep it short. A shorter lifetime means a change (new role, disabled account) takes effect sooner, but costs a few more refreshes. 15 minutes is a good default.
Refresh token: this is “how long until I must sign in again.” 30 days suits consumer apps; banking apps use hours. It resets whenever the person is active.
Sessions per user: set a limit for paid seats or sensitive tools, so one account can’t be shared by a whole team.

Read the session in your app

const session = await pawabase.auth.getSession();     // null when signed out; no network call
const user = await pawabase.auth.getUser();           // fresh from the server, updates the stored copy
const token = await pawabase.auth.getAccessToken();  // for calling your own backend

session = pb.auth.session            # None when signed out
user = pb.auth.get_user()
token = pb.auth.access_token

A session holds access_token, refresh_token, expires_at, session_id, the active org and org_role, and the user.

React to changes

Subscribe once, near the top of your app:

const { unsubscribe } = pawabase.auth.onAuthStateChange((event, session) => {
  if (event === "SIGNED_OUT") navigate("/sign-in");
  if (event === "SIGNED_IN") navigate("/");
});

stop = pb.auth.on_auth_state_change(lambda event, session: print(event))

Event	When
`INITIAL_SESSION`	Right after load, with whatever was stored
`SIGNED_IN`	A sign-in or sign-up finished
`SIGNED_OUT`	Signed out, or the session ended
`TOKEN_REFRESHED`	The access token was renewed
`USER_UPDATED`	The profile changed

Sign out

await pawabase.auth.signOut();                         // this device
await pawabase.auth.signOut({ scope: "others" });      // every other device
await pawabase.auth.signOut({ scope: "global" });      // everywhere

pb.auth.sign_out()
pb.auth.sign_out(scope="others")
pb.auth.sign_out(scope="global")

The device is always signed out locally, even if the server couldn’t be reached. A SIGNED_OUT event fires.

Show “where you’re signed in”

const sessions = await pawabase.auth.sessions.list();
// [{ id, method, aal, ip, user_agent, created_at, last_refreshed_at, current }]

await pawabase.auth.sessions.revoke(sessions[1].id);     // sign out one device
const history = await pawabase.auth.sessions.history();   // recent sign-ins and failures

sessions = pb.auth.sessions.list()
pb.auth.sessions.revoke(sessions[1]["id"])
history = pb.auth.sessions.history()

Put this on the account page. current marks the session making the request; don’t offer to revoke that one, use sign-out instead.

Revoke from the admin side

To end sessions yourself in Studio: Users & auth → Security → Sessions lists live sessions, and a person’s own page (Users → the person → Security) can end them. To sign a person out everywhere, open them and use Sessions.

Where the session is stored

Where	Default
Browser	`localStorage`
Node, server	Memory (gone when the process ends)
Python	Memory, or a file with `FileSessionStore`

Change it in the client options. React Native passes AsyncStorage; a cookie-based framework passes its own object with getItem, setItem and removeItem:

const pawabase = createClient({
  url, apiKey,
  auth: { storage: asyncStorage, persistSession: true, autoRefreshToken: true, refreshMarginSeconds: 60 },
});

Set persistSession: false for a script that should remember nothing. In Python: Pawabase(url, key, session_store=FileSessionStore("~/.myapp/session.json")).

Two tabs refreshing at the same moment would end the session, because refresh tokens are single-use. The client prevents this by sharing one refresh across calls and, in browsers, across tabs. You don’t need to do anything.

Events

session.revoked fires when a session ends (signed out, expired or revoked), and session.reuse_detected when a stolen refresh token was replayed and the family was revoked. See Auth webhooks.

Devices

Track and remember devices.

Auth in React

Use sessions in components.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

Session settings

Active sessions

Choosing lifetimes

Read the session in your app

React to changes

Sign out

Show “where you’re signed in”

Revoke from the admin side

Where the session is stored

Events

Devices

Auth in React

​In Studio

​Session settings

​Active sessions

​Choosing lifetimes

​Read the session in your app

​React to changes

​Sign out

​Show “where you’re signed in”

​Revoke from the admin side

​Where the session is stored

​Events

Devices

Auth in React

In Studio

Session settings

Active sessions

Choosing lifetimes

Read the session in your app

React to changes

Sign out

Show “where you’re signed in”

Revoke from the admin side

Where the session is stored

Events