# Sign out and end sessions

> Sign out of the dashboard, and learn how long a signed-in browser or script stays signed in and how to end every session.

Source: https://www.coritan.com/docs/account/sessions/

A *session* is a browser or a script that is signed in to your account. Signing out ends the session in the browser you are using. To end every session at once, change your password.

## Before you begin

- Sign in to the [dashboard](https://www.coritan.com/dashboard).

## Sign out of this browser

1. At the top right of the dashboard, select your initials.
2. Select **Sign out**.

You can also sign out from **Settings**: on the **Security** tab, the **Sessions** card has **Sign out of this device**. On coritan.com's own pages, **Sign out** is at the top of the page.

Signing out makes this browser forget its tokens. Coritan does not cancel them: a copy of a token taken from the browser keeps working until it expires. If you think someone has one, [end every session](#end-every-session).

## End every session

1. In the sidebar, select **Settings**, then the **Security** tab.
2. [Change your password](/docs/account/password/#change-your-password).

Every token issued before the change stops working, the one in this browser included. Every browser and script then has to sign in again, with your new password and, if it is on, a code from your authenticator app. [Resetting a forgotten password](/docs/account/password/#reset-a-forgotten-password) has the same effect.

## How long a session lasts

Signing in gives a browser or a script two tokens:

Access token
: Proves who you are on each request. It lasts a short time: 30 minutes unless Coritan changes the setting.

Refresh token
: Gets a new pair of tokens when the access token runs out. It lasts 30 days unless Coritan changes the setting, and each new pair starts a new refresh token with a full lifetime.

The dashboard renews its tokens on its own, so a browser you use at least once within the refresh token's lifetime stays signed in until you sign out. A script does the same with `POST /auth/refresh`, as [Make your first API request](/docs/get-started/first-steps-with-the-api/#5-renew-the-access-token) shows.

## Result

The browser you signed out of shows the sign-in page. After a password change, every other browser shows the sign-in page the next time it contacts Coritan, and scripts get `401` answers until they sign in again.

The **Sessions** card on the **Security** tab lists only the browser you are using, marked **This device**. Coritan keeps no list of your other sessions, so the dashboard cannot show them or end them one at a time.

## Troubleshooting

The dashboard signed you out on its own
: The refresh token expired, someone changed or reset the password, or Coritan suspended the account. If you did not change the password, [reset it](/docs/account/password/#reset-a-forgotten-password) and [turn on two-factor authentication](/docs/account/two-factor-authentication/).

A script gets `401` with `Token invalidated by password change`
: The password changed after the script signed in. Sign it in again with the new password.

A script gets `403` with `Account is suspended or closed`
: The account cannot be used. [Contact support](/docs/support/).

## Related

- [Change or reset your password](/docs/account/password/)
- [Turn on two-factor authentication](/docs/account/two-factor-authentication/)
- [Authentication](/docs/api/authentication/)

## With the API

The API has no sign-out endpoint and no list of sessions. To end a script's session, delete its tokens. To end every session, change the password with `POST /auth/me/password`, as [Change or reset your password](/docs/account/password/#with-the-api) shows: every earlier token then answers `401` with `Token invalidated by password change`.