Skip to main content
Every time you sign in to Woku from a new browser or device, a session is created. Sessions stay active until:
  • The idle timeout elapses (30 minutes without activity by default), or
  • You log out explicitly, or
  • You revoke them from your profile, or
  • An administrator closes them for security reasons.

​
View your active sessions

  1. In admin.woku.app, open your profile.
  2. Go to the “Active sessions” section.
  3. You will see each session with:
    • Last activity: the last time that session made an authenticated request.
    • Started: when it was created.
    • Configured timeout (if applicable).
Tokens do not appear in the list, only metadata. There is no way to export or copy a session token from the UI.

​
Revoke a session

Click Revoke next to the session you want to close. The closure is immediate: the next request that uses that token receives 401 Unauthorized. Typical cases:
  • You signed in on a borrowed computer and forgot to log out.
  • You suspect a device was compromised.
  • You want to force a re-login across all tabs.

​
You can only revoke your own sessions

The backend validates that the session you are closing belongs to you. If you try to close another user’s session, the API responds 403 Forbidden.

​
What if I want to close ALL my sessions?

For now, one by one. The “close all” action is coming in a later release. In the meantime, one option is to change your password (not implemented yet in V1, coming as part of the recovery flow improvement) or to ask an internal administrator.

​
Known limitation

V1 does not show IP or user-agent per session. That information is captured in the audit log for any action the user performed. Showing it per session is a follow-up in the backlog.