# How long sign-ins last, and signing people out Set how long a sign-in and a trusted device last, how long a connected app or agent keeps working, and sign one person out of a device or a session. A sign-in lasts a set number of days. A device the person chose to trust stays signed in longer and is not asked again. An app or AI agent a person approved keeps working for its own number of days. You set all three on the **Security** tab of Authentication. When one person needs signing out, of one device or one session, you do it from their page in **Users**. > **Note:** A console role that can change your sign-in settings. Changes apply to new sign-ins; a shorter limit also ends older connections at their next refresh, as each field says. ## 1. Open Security [Open Security in the console](https://console.buildbase.app/dashboard/admin/auth?tab=security) In the left rail choose **Users**, then **Security** under **Access**. It is the **Security** tab of Authentication. ![The Security tab of Authentication, with the Security menu item under Access highlighted as step 1, and the cards Security & sessions, Connected apps and agents, Two-step sign-in, Bot protection, Disposable email addresses and Account deletion](/images/sign-in-setup/sessions-and-devices/console-security-tab.webp) ## 2. How long a sign-in lasts In **Security & sessions**: - **Ask to trust new devices**: the first time someone signs in from a device the platform does not recognise, they are asked **Trust this device?** Trusting keeps them signed in longer and skips the question next time. - **Session lifetime (days)**: how long a normal sign-in stays valid, from 1 to 180. - **Trust a device for (days)**: how long a trusted device stays signed in and is not asked again. Press **Update**. ![The Security & sessions card: Ask to trust new devices switched on, Session lifetime (days) 30 and Trust a device for (days) 90, with the Update button highlighted as step 2](/images/sign-in-setup/sessions-and-devices/console-security-sessions.webp) ## 3. How long a connected app or agent lasts When a person approves another app or an AI agent to act for them, the connection keeps working until it ends here. In **Connected apps and agents**: - **App connection lasts (days)**: from 1 to 365, however often the app is used. - **End an unused app connection after (days)**: from 0 to 180; 0 keeps it however long it goes unused. - **Agent connection lasts (days)**: from 0 to 365; 0 sets no limit. - **End an unused agent connection after (days)**: from 1 to 180. Press **Save**. A shorter value also ends older connections; a longer one applies from their next use. ![The Connected apps and agents card: App connection lasts (days) 180, End an unused app connection after (days) 0, Agent connection lasts (days) 0 and End an unused agent connection after (days) 30, with the Save button highlighted as step 3](/images/sign-in-setup/sessions-and-devices/console-connected-apps.webp) ## 4. See one person's devices In the left rail choose **Users**, open the person, and choose the **Devices** tab. **Devices & sessions** lists each device they signed in on, with its browser, system and IP address, how many sessions are live on it, and whether they trusted it. Under it, **Active sessions** lists each live sign-in. ![A person's Devices tab: Devices & sessions, 2 devices and 1 active session, and the device Chrome on Mac OS, Trusted, 127.0.0.1, 1 active session, highlighted as step 4, with its Sign out button](/images/sign-in-setup/sessions-and-devices/console-user-devices.webp) ## 5. Sign them out - **Sign out** on a device ends every session on it. They stay signed in on their other devices. - The bin beside it, **Sign out and remove**, also removes the device from their history, so it is unrecognised, and asked to be trusted, next time. - **Revoke** on a session under **Active sessions** ends that one session. Confirm with **Revoke session**. ![The dialog Revoke this session?: The session on Chrome on Mac OS ends now, and the user signs in again there. Their other sessions stay. The Revoke session button highlighted beside Cancel](/images/sign-in-setup/sessions-and-devices/console-revoke-session.webp) The person can do the same for themselves in your app, on the **Devices** screen of the SDK's settings dialog. Over the API, `DELETE /api/users/:id/devices/:deviceId` and `DELETE /api/users/:id/sessions/:sessionRef` do it for a support tool of your own ([Users](/users/overview#administering-users-over-the-api)). ## A lost phone When someone with two-step sign-in loses their phone and their backup codes, open their page and choose **More**, then **Reset two-step sign-in**. The item shows only for someone who has two-step sign-in on. See [Two-step sign-in](/sign-in-setup/two-step#a-lost-phone). ## Check it works Sign in to your app as a test user in two browsers. Their **Devices** tab shows two devices. **Sign out** one: that browser is signed out on its next request, and the other stays signed in. ## Things to watch out for - **Signing out does not block.** The person can sign in again at once. To stop them, use **Block** on their page. - **A trusted device lasts longer than a session.** **Trust a device for (days)** decides how long a trusted device stays signed in, not **Session lifetime (days)**. - **A shorter connection limit ends older connections.** Lowering a limit under **Connected apps and agents** ends the connections already older than it; raising one applies from each connection's next use. ## Next steps - [Set up sign-in, step by step](/sign-in-setup/overview) - every guide, in the order to set them up. - [Sessions and tokens](/authentication/sessions-and-tokens#devices-and-active-sessions) - devices and sessions from the developer's side. - [Two-step sign-in](/sign-in-setup/two-step) - a second step at sign-in, and trusted devices. - [Users](/users/overview) - everything on a person's page. - [Agent access](/sign-in-setup/agent-access) - agents that act for your users.