Sessions

A ws-session cookie is minted on every sign-in and lives 30 days. These three endpoints let you see them and end them. They are on https://dash.square1.dev and accept either the cookie or a Bearer API key.

Sessions and API keys are separate credentials with separate lifecycles. Revoking sessions does not touch your keys, and rotating your keys does not end your sessions. To cut off both, do both.

List sessions — `GET /api/user/me/sessions`

curl https://dash.square1.dev/api/user/me/sessions \
  -H "Authorization: Bearer $SQUARE1_API_KEY"

{
  "success": true,
  "data": {
    "sessions": [
      {
        "id": "3f9a1c07be24d5a8",
        "ip": "121.140.••.••",
        "userAgent": "Mozilla/5.0 (Macintosh; ...)",
        "createdAt": "2026-08-28T09:12:44.000Z",
        "expiresAt": "2026-09-27T09:12:44.000Z",
        "current": true
      }
    ]
  }
}

Unexpired sessions only, newest first, capped at 200 rows.

Field	Notes
`id`	16 lowercase hex characters. A prefix of the session hash, not the session token — see below
`ip`	Masked by the server. IPv4 keeps the first two octets (`121.140.••.••`); IPv6 keeps all but the last four groups; an unparseable value becomes `•••` and a missing one becomes `—`
`userAgent`	The raw `User-Agent` string at sign-in, or `null`
`createdAt`, `expiresAt`	ISO 8601 strings
`current`	Whether this row is the session making the request

The full IP is never sent. There is no parameter to unmask it — the masking happens before the row leaves the server.

About `id`

id is the first 16 hex characters of the session token’s SHA-256, not the token itself. It is not a secret: the only thing it can do is delete your own session, because every query behind these endpoints is scoped to your account.

`current` under Bearer auth

If you authenticate with a Bearer API key, current is false on every row — and that is correct, not a bug. Key authentication does not create a session row, so the caller genuinely isn’t any of the listed devices.

The cap of 200 applies to this listing only. Rows beyond it still exist and are still ended by revoke others below.

Revoke one session — `DELETE /api/user/me/sessions/:id`

curl -X DELETE https://dash.square1.dev/api/user/me/sessions/3f9a1c07be24d5a8 \
  -H "Authorization: Bearer $SQUARE1_API_KEY"

{ "success": true }

HTTP	`code`	Meaning
409	`session_is_current`	`:id` is the session you’re using right now
404	—	No such session on your account (also covers a malformed `:id`)

You cannot delete your own current session here. That is intentional — removing a row from a device list shouldn’t silently log you out. Sign out normally instead, or use revoke-others to clear everything else.The 409 is only reachable when you authenticate with the cookie. Under Bearer auth no row is current, so any valid id deletes.

Each successful revocation is audited.

Revoke every other session — `POST /api/user/me/sessions/revoke-others`

curl -X POST https://dash.square1.dev/api/user/me/sessions/revoke-others \
  -H "Authorization: Bearer $SQUARE1_API_KEY"

{ "success": true, "data": { "revoked": 4 } }

revoked is the number of session rows deleted.

Under Bearer API key auth this revokes all sessions, including the browser you’re reading this in. With no cookie on the request there is no session to preserve, so “all other sessions” means every one of them. Under cookie auth, the calling session is kept.

Unlike the listing, this is not capped at 200 — sessions that were truncated out of the list are ended too. The audit record stores the count only, not which devices.

Changing your password revokes every session and reissues the current one in the same request — see Password and passkeys.
API keys are managed separately at API keys.

Getting started

Core concepts

Guides

Account API

Public data

List sessions — `GET /api/user/me/sessions`

About `id`

`current` under Bearer auth

Revoke one session — `DELETE /api/user/me/sessions/:id`

Revoke every other session — `POST /api/user/me/sessions/revoke-others`

​List sessions — GET /api/user/me/sessions

​About id

​current under Bearer auth

​Revoke one session — DELETE /api/user/me/sessions/:id

​Revoke every other session — POST /api/user/me/sessions/revoke-others

​Related

List sessions — `GET /api/user/me/sessions`

About `id`

`current` under Bearer auth

Revoke one session — `DELETE /api/user/me/sessions/:id`

Revoke every other session — `POST /api/user/me/sessions/revoke-others`

Related