Sign out and end sessions

A session is one browser or script signed in to your account. The Sessions card on the Security tab of Settings lists them, so you can see where you are signed in and sign out a device you no longer use or do not recognise. It also lists any support session Coritan support opened to help with your account, which you can end the same way.

• Sign in to the dashboard.

1. In the sidebar, select Settings, then the Security tab.
2. Find the Sessions card.

Each row is one device, with the most recently active first:

• the browser and system, such as Chrome on macOS, or the program's name for a script, such as curl
• when it was last active, such as Active 3 hours ago, and the country its address is in
• its IP address and the date it signed in

The browser you are using is marked This device. The card lists up to 100 devices.

A session that Coritan support opened reads Coritan support session (read-only) or Coritan support session (full access), with the time it ends. It shows no place or address, because those are the support agent's (Coritan support sessions).

1. On the Sessions card, find the device.
2. Select the sign-out button at the end of its row.

A message confirms it, such as Chrome on macOS signed out. Within 10 seconds, the device's tokens stop working: a browser shows the sign-in page the next time it contacts Coritan, and a script gets 401 answers.

1. On the Sessions card, select Sign out other devices…. The button shows while another device is signed in.
2. Select Sign out other devices to confirm.

A message confirms how many were signed out, such as 2 other devices signed out. Every other browser and script needs your password to sign in again. This browser stays signed in.

Changing your password signs out every other device in the same way.

1. At the top right of the dashboard, select your initials.
2. Select Sign out.

You can also select Sign out of this device on the Sessions card. On coritan.com's own pages, Sign out is at the top of the page.

Signing out ends the session on the server as well, so a copy of this browser's tokens stops working too.

Signing in gives a browser or a script two tokens:

Access token

Proves who you are on each request. It lasts 30 minutes unless Coritan changes the setting.

Refresh token

Gets a new pair of tokens when the access token runs out. Each refresh token works once, and the new pair holds a new one that lasts 30 days unless Coritan changes the setting.

The dashboard renews its tokens on its own, so a browser you use at least once every 30 days stays signed in until you sign out. A session that nobody renews for 30 days ends.

A script renews with POST /auth/refresh, as Make your first API request shows, and must keep the new refresh token each time. Sending a refresh token that was already used signs the session out, unless it arrives within a minute of the first use, as when two browser tabs renew at the same moment.

To help with your account, Coritan support can open a support session from Coritan's admin console. It signs one browser tab in to your account, so they see the dashboard as you do. Only Coritan staff can open one, with one of two kinds of access:

Read-only

They can open every page, and Coritan refuses every change.

Full access

They can make changes as you, and Coritan records each one against the member of staff who made it.

Even with full access, a support session cannot:

• change anything on Settings: your profile, billing address, password, email, two-factor authentication, sessions, notifications, team or API keys
• close the account
• change who can act for an organization you belong to (its members, API keys, OAuth clients and staff team), or hand the organization over to someone else
• finish an action in an organization that asks to confirm it is you
• sign in as one of your organization's customers

No support session can open your mailboxes, so Coritan staff cannot read your mail in webmail this way.

A support session lasts 30 minutes from when it opens, and nobody can renew it. Your own browsers stay signed in while it runs.

The tab opens at https://www.coritan.com/auth/support-session, which checks the link with Coritan and then opens your dashboard. A banner at the top of every page starts with Signed in as and your name or email, says whether the session is read-only or has full access and when it ends, and has End session. The tab has no webmail link, and it cannot switch to another account.

The session ends when staff select End session, when its 30 minutes run out, or when you sign it out. The tab then shows Support session ended and is no longer signed in to your account.

1. In the sidebar, select Settings, then the Security tab.
2. On the Sessions card, find the row that reads Coritan support session (read-only) or Coritan support session (full access). It shows the time the session ends, such as Ends at 10:00, and Coritan staff opened it to help with your account.
3. Select the sign-out button at the end of its row.

A message confirms it, such as Coritan support session (read-only) signed out. Within 10 seconds, Coritan refuses the support tab's requests, and the tab shows Support session ended the next time it contacts Coritan. Sign out other devices… and changing your password end every support session too.

A device you signed out disappears from the Sessions card. It shows the sign-in page the next time it contacts Coritan, and a script gets 401 with This session was signed out until it signs in again. A support session you signed out disappears too, and its tab shows Support session ended.

The dashboard signed you out on its own

The session ended. Someone signed this device out from another one, the password changed, nobody used the browser for 30 days, or Coritan suspended or closed the account. If it was not you, reset your password, which signs out every device, and turn on two-factor authentication.

A script gets 401 with This session was signed out

The script's session was signed out on the Sessions card, with Sign out other devices… or with POST /auth/logout, or the script sent a refresh token it had already used. Sign it in again, and keep the new refresh token after each renewal.

A script gets 401 with Token invalidated by password change

The password changed after the script signed in. Sign it in again with the new password.

A script gets 403 with Account is suspended or closed

The account cannot be used. Contact support.

A device you use is not on the card

A browser that signed in with two-factor authentication, or when you created the account, appears once it first renews its tokens. That happens the first time it is used after its access token runs out. To sign such a device out before then, change your password.

Session not found

The device was already signed out, from another browser or because it signed itself out. The card reloads the list.

A Coritan support session you did not expect is on the card

Sign it out from its row (End a support session), then contact support.

This sign-in link has expired or is not a support session.

The page at https://www.coritan.com/auth/support-session only opens support sessions, from links Coritan's admin console makes. To use your own account, sign in.

• Change or reset your password
• Turn on two-factor authentication
• Authentication

GET /auth/sessions lists the sessions that can still be used, with the most recently active first and at most 100:

curl https://api.coritan.com/api/v1/auth/sessions \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "sessions": [
    {
      "id": 8812,
      "ip_address": "203.0.113.10",
      "country_code": "GB",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0 Safari/537.36",
      "created_at": "2026-09-20T08:14:03",
      "last_seen_at": "2026-09-26T09:41:10",
      "expires_at": "2026-10-26T09:41:10",
      "current": true,
      "support_session": false,
      "support_mode": null
    },
    {
      "id": 8813,
      "ip_address": "198.51.100.7",
      "country_code": "NL",
      "user_agent": "Coritan support session (admin #12)",
      "created_at": "2026-09-26T09:30:00",
      "last_seen_at": "2026-09-26T09:30:00",
      "expires_at": "2026-09-26T10:00:00",
      "current": false,
      "support_session": true,
      "support_mode": "read_only"
    }
  ]
}

id

The session's number, which signs it out.

ip_address and country_code

The address it last signed in or renewed its tokens from, and the two-letter code of that address's country, or null when Coritan cannot place it.

user_agent

What the browser or script called itself when it last signed in or renewed its tokens.

created_at, last_seen_at and expires_at

When it signed in, when it last renewed its tokens, and when it ends unless it renews them again.

current

true for the session of the token that made the request.

support_session and support_mode

true and read_only or full for a Coritan support session, and false and null for any other. A support session's ip_address, country_code and user_agent are the support agent's, and its expires_at is 30 minutes after it opened.

DELETE /auth/sessions/{session_id} signs out one session:

curl -X DELETE https://api.coritan.com/api/v1/auth/sessions/8790 \
  -H "Authorization: Bearer $CORITAN_TOKEN"

It answers {"revoked": true, "current": false}. current is true when you signed out the session that made the request. A session that is not yours, or is already signed out, answers 404 with Session not found. It signs out a Coritan support session in the same way.

POST /auth/sessions/revoke-others signs out every session except the one that made the request, and answers how many it ended, such as {"revoked": 2}. The answer can also hold access_token, refresh_token, token_type and expires_in, when the request's token had no session of its own yet. Use those tokens from then on.

POST /auth/logout signs out the session that a token belongs to. Send the access token as the bearer token, the refresh token in the body, or both. When the access token has expired, the refresh token in the body is enough.

curl -X POST https://api.coritan.com/api/v1/auth/logout \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"refresh_token\": \"$CORITAN_REFRESH\"}"

It answers {"message": "Signed out", "revoked": true}, and revoked is false when the tokens name no session. With neither token, it answers 401 with Not signed in. From then on, both tokens answer 401 with This session was signed out.