> ## Documentation Index
> Fetch the complete documentation index at: https://docs.square1.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Sessions

> See where you're signed in, and cut off a device you lost

A `ws-session` cookie is minted on every sign-in and lives 30 days. These
three endpoints let you see them and end them. They are on
`https://dash.square1.dev` and accept either the cookie or a Bearer API key.

<Note>
  Sessions and API keys are separate credentials with separate lifecycles.
  Revoking sessions does not touch your keys, and rotating your keys does not
  end your sessions. To cut off both, do both.
</Note>

## List sessions — `GET /api/user/me/sessions`

```bash theme={null}
curl https://dash.square1.dev/api/user/me/sessions \
  -H "Authorization: Bearer $SQUARE1_API_KEY"
```

```json theme={null}
{
  "success": true,
  "data": {
    "sessions": [
      {
        "id": "3f9a1c07be24d5a8",
        "ip": "121.140.••.••",
        "userAgent": "Mozilla/5.0 (Macintosh; ...)",
        "createdAt": "2026-08-28T09:12:44.000Z",
        "expiresAt": "2026-09-27T09:12:44.000Z",
        "current": true
      }
    ]
  }
}
```

Unexpired sessions only, **newest first**, capped at **200 rows**.

| Field                    | Notes                                                                                                                                                                                  |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `id`                     | 16 lowercase hex characters. A prefix of the session hash, not the session token — see below                                                                                           |
| `ip`                     | **Masked by the server.** IPv4 keeps the first two octets (`121.140.••.••`); IPv6 keeps all but the last four groups; an unparseable value becomes `•••` and a missing one becomes `—` |
| `userAgent`              | The raw `User-Agent` string at sign-in, or `null`                                                                                                                                      |
| `createdAt`, `expiresAt` | ISO 8601 strings                                                                                                                                                                       |
| `current`                | Whether this row is the session making the request                                                                                                                                     |

<Note>
  The full IP is never sent. There is no parameter to unmask it — the
  masking happens before the row leaves the server.
</Note>

### About `id`

`id` is the first 16 hex characters of the session token's SHA-256, not the
token itself. It is not a secret: the only thing it can do is delete *your
own* session, because every query behind these endpoints is scoped to your
account.

### `current` under Bearer auth

<Warning>
  If you authenticate with a **Bearer API key**, `current` is `false` on
  every row — and that is correct, not a bug. Key authentication does not
  create a session row, so the caller genuinely isn't any of the listed
  devices.
</Warning>

The cap of 200 applies to this listing only. Rows beyond it still exist and
are still ended by **revoke others** below.

## Revoke one session — `DELETE /api/user/me/sessions/:id`

```bash theme={null}
curl -X DELETE https://dash.square1.dev/api/user/me/sessions/3f9a1c07be24d5a8 \
  -H "Authorization: Bearer $SQUARE1_API_KEY"
```

```json theme={null}
{ "success": true }
```

| HTTP | `code`               | Meaning                                                         |
| ---- | -------------------- | --------------------------------------------------------------- |
| 409  | `session_is_current` | `:id` is the session you're using right now                     |
| 404  | —                    | No such session on your account (also covers a malformed `:id`) |

<Note>
  **You cannot delete your own current session here.** That is intentional —
  removing a row from a device list shouldn't silently log you out. Sign out
  normally instead, or use revoke-others to clear everything else.

  The `409` is only reachable when you authenticate with the cookie. Under
  Bearer auth no row is current, so any valid id deletes.
</Note>

Each successful revocation is audited.

## Revoke every other session — `POST /api/user/me/sessions/revoke-others`

```bash theme={null}
curl -X POST https://dash.square1.dev/api/user/me/sessions/revoke-others \
  -H "Authorization: Bearer $SQUARE1_API_KEY"
```

```json theme={null}
{ "success": true, "data": { "revoked": 4 } }
```

`revoked` is the number of session rows deleted.

<Warning>
  **Under Bearer API key auth this revokes *all* sessions, including the
  browser you're reading this in.** With no cookie on the request there is no
  session to preserve, so "all other sessions" means every one of them. Under
  cookie auth, the calling session is kept.
</Warning>

Unlike the listing, this is not capped at 200 — sessions that were truncated
out of the list are ended too. The audit record stores the count only, not
which devices.

## Related

* Changing your password revokes every session and reissues the current one
  in the same request — see
  [Password and passkeys](/account/passwords-passkeys#change-your-password).
* API keys are managed separately at [API keys](/account/api-keys).