April 3, 2026 — "Am I signed in on a device I don't use anymore?" is the kind of question a user should never have to guess at. Starting today, every SyAuth account has a clean answer: a list of every active session, with a one-click revoke for each, and a sign out of all other devices button for the rare case you need it.
What you see
Each row shows the device's user agent, IP address, when it was created, and when it was last active. The session making the request is marked "This device" so you never accidentally sign yourself out. Anything revoked is kept visible in the list with a "Revoked" badge and timestamp, so your support team has a paper trail if a user calls in about a compromise.
How revocation actually works
Revocation is not cosmetic. Both the refresh-token jti and the captured access-token jti are pushed to our persistent token denylist, the same mechanism our auth middleware already consults on every authenticated request. Revoked tokens are rejected immediately — even if the JWT itself is still syntactically valid, even if Redis restarts.
Security team features, without the bolt-on feel
- Sign-out-everywhere on password change. Wire a single API call to
DELETE /user/sessions/and every session but the one changing the password is invalidated instantly. - OAuth-client context retained. Each session remembers which OAuth client minted it, so developers can answer "who signed in from which app?" when diagnosing incidents.
- Every revocation logged.
session_revokeandsession_revoke_allentries land in your workspace's immutable audit log, so account takeovers have a forensic trail.
No setup required — the UI is live at /security/sessions and the API is documented on the developer portal.