TILLAUTH · OPERATE

Sessions.

API

Every sign-in creates a session. Give your users a "where you're signed in" screen: list their active sessions, sign out a single device, or sign out everywhere but here. All three calls use the user's own access token — build the UI in your app.

01Read

List sessions

Returns one entry per login session, the current one flagged and pinned first.

GET https://auth.tilldev.dev/v1/sessions
Authorization: Bearer <access_token>

Field	Meaning
`sid`	Session id — pass this to revoke.
`current`	True for the session making this request.
`status`	`active`, `expired`, or `revoked`.
`device_id`	The device this session is bound to (if known).
`ip`	Last-seen IP address.
`started_at`	When the session was first created.
`last_seen_at`	When it was last refreshed.

02Write

Sign out a device

Revoke one session by its sid. This ends the whole session — it can never be renewed, and its live token stops being accepted shortly after. A user can only revoke their own sessions.

POST https://auth.tilldev.dev/v1/sessions/revoke
Authorization: Bearer <access_token>
Content-Type: application/json

{ "sid": "<sid>" }

→ { "ok": true, "revoked": 1 }

03Write

Sign out everywhere else

After a password change, or from a "secure my account" button, end every session except the current one in a single call.

POST https://auth.tilldev.dev/v1/sessions/revoke-others
Authorization: Bearer <access_token>

→ { "ok": true, "revoked": 3 }

Note

The session that makes this call stays signed in; every other one is ended.

04Admin

Revoke on someone's behalf

To end a user's sessions from your own back office — offboarding, a support action — use the admin endpoint with an app admin token instead of the user's token:

DELETE /v1/admin/apps/<appId>/users/<userId>/sessions

For fully automated offboarding driven by your identity provider, see SCIM provisioning — marking a user inactive there revokes their sessions for you.