Manage user sessions

Store tokens safely with proper cookie security, validate on every request, and refresh with rotation to keep sessions secure

User sessions determine how long users stay signed in to your application. After users successfully authenticate, you receive session tokens that manage their access. These tokens control session duration, multi-device access, and cross-product authentication within your company’s ecosystem.

Store those tokens securely, validate them on every request, and refresh them before they expire. Session middleware writes one encrypted sk_session cookie and does that work for you. You can still store and refresh tokens yourself if you prefer.

Review the session management sequence

User session management flow diagram showing how access tokens and refresh tokens work together

Store the session

After hosted login, session middleware writes one encrypted sk_session cookie. You do not set accessToken or refreshToken cookies.

Add COOKIE_ENCRYPTION_SECRET to .env. Generate it with openssl rand -base64 32. Use the same value on every server.

Express
Next.js

Install @scalekit-sdk/node 2.12.0 or later. Mount auth.router. It registers /login, /callback, and /logout. The callback writes sk_session.

1
import express from 'express';
2
import { ScalekitAuth } from '@scalekit-sdk/node/express';
3

4
const auth = new ScalekitAuth({
5
  envUrl: process.env.SCALEKIT_ENVIRONMENT_URL,
6
  clientId: process.env.SCALEKIT_CLIENT_ID,
7
  clientSecret: process.env.SCALEKIT_CLIENT_SECRET,
8
  redirectUri: process.env.REDIRECT_URI,
9
  cookieEncryptionSecret: process.env.COOKIE_ENCRYPTION_SECRET,
10
});
11

12
const app = express();
13
app.use(auth.router);

Install @scalekit-sdk/node 2.12.0 or later. Create one auth instance. Export login, callback, and logout Route Handlers. The callback writes sk_session.

1
import { ScalekitClient } from '@scalekit-sdk/node';
2
import { ScalekitAuthNext } from '@scalekit-sdk/node/next';
3

4
const scalekit = new ScalekitClient(
5
  process.env.SCALEKIT_ENVIRONMENT_URL!,
6
  process.env.SCALEKIT_CLIENT_ID!,
7
  process.env.SCALEKIT_CLIENT_SECRET!
8
);
9

10
export const auth = new ScalekitAuthNext({
11
  client: scalekit,
12
  redirectUri: process.env.REDIRECT_URI!,
13
  cookieEncryptionSecret: process.env.COOKIE_ENCRYPTION_SECRET!,
14
});

1
import { auth } from '../../lib/auth';
2
export const GET = auth.createLoginHandler();

1
import { auth } from '../../lib/auth';
2
export const GET = auth.createCallbackHandler();

1
import { auth } from '../../lib/auth';
2
export const GET = auth.createLogoutHandler();

Pin runtime: 'nodejs' in middleware.ts, or pass ScalekitEdgeClient for Edge Runtime.

Flask
FastAPI

Install scalekit-sdk-python 2.17.0 or later with the Flask extra. ScalekitAuth registers /login, /callback, and /logout and writes sk_session.

1
import os
2
from flask import Flask
3
from scalekit.frameworks.flask import ScalekitAuth
4

5
app = Flask(__name__)
6
auth = ScalekitAuth(
7
    app,
8
    env_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],
9
    client_id=os.environ["SCALEKIT_CLIENT_ID"],
10
    client_secret=os.environ["SCALEKIT_CLIENT_SECRET"],
11
    redirect_uri=os.environ["REDIRECT_URI"],
12
    cookie_encryption_secret=os.environ["COOKIE_ENCRYPTION_SECRET"],
13
    # HTTP localhost drops a Secure cookie, so the session never sticks.
14
    # A missing Secure flag on real HTTP lets the browser send sk_session in cleartext.
15
    cookie_secure=False,
16
)

Install scalekit-sdk-python 2.17.0 or later with the FastAPI extra. Call auth.install(app) to register routes and write sk_session.

1
import os
2
from fastapi import FastAPI
3
from scalekit.frameworks.fastapi import ScalekitAuth
4

5
app = FastAPI()
6
auth = ScalekitAuth(
7
    env_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],
8
    client_id=os.environ["SCALEKIT_CLIENT_ID"],
9
    client_secret=os.environ["SCALEKIT_CLIENT_SECRET"],
10
    redirect_uri=os.environ["REDIRECT_URI"],
11
    cookie_encryption_secret=os.environ["COOKIE_ENCRYPTION_SECRET"],
12
    # HTTP localhost drops a Secure cookie, so the session never sticks.
13
    # A missing Secure flag on real HTTP lets the browser send sk_session in cleartext.
14
    cookie_secure=False,
15
)
16
auth.install(app)


7 collapsed lines
1
import (
2
  "net/http"
3
  "os"
4
  "time"
5
  "github.com/gin-gonic/gin"
6
)
7

8
// Extract authentication data from the successful authentication response
9
accessToken := authResult.AccessToken
10
expiresIn := authResult.ExpiresIn
11
refreshToken := authResult.RefreshToken
12
user := authResult.User
13

14
// Encrypt tokens before storing to add an additional security layer
15
encryptedAccessToken := encrypt(accessToken)
16
encryptedRefreshToken := encrypt(refreshToken)
17

18
// Set SameSite mode for CSRF protection
19
c.SetSameSite(http.SameSiteStrictMode) // Prevents CSRF attacks
20

21
// Store encrypted access token in HttpOnly cookie
22
c.SetCookie(
23
  "accessToken",
24
  encryptedAccessToken,
25
  expiresIn-60, // Subtract 60s buffer for clock skew (seconds in Gin)
26
  "/",          // Available on all routes
27
  "",
28
  os.Getenv("GIN_MODE") == "release", // HTTPS-only in production
29
  true, // Prevents JavaScript access to mitigate XSS attacks
30
)
31

32
// Store encrypted refresh token in separate HttpOnly cookie
33
c.SetCookie(
34
  "refreshToken",
35
  encryptedRefreshToken,
36
  0,    // No expiry for refresh token cookie (session lifetime controlled server-side)
37
  "/",  // Available on all routes
38
  "",
39
  os.Getenv("GIN_MODE") == "release", // HTTPS-only in production
40
  true, // Prevents JavaScript access to mitigate XSS attacks
41
)


6 collapsed lines
1
import javax.servlet.http.Cookie;
2
import javax.servlet.http.HttpServletResponse;
3
import org.springframework.core.env.Environment;
4
@Autowired
5
private Environment env;
6

7
// Extract authentication data from the successful authentication response
8
String accessToken = authResult.getAccessToken();
9
int expiresIn = authResult.getExpiresIn();
10
String refreshToken = authResult.getRefreshToken();
11
User user = authResult.getUser();
12

13
// Encrypt tokens before storing to add an additional security layer
14
String encryptedAccessToken = encrypt(accessToken);
15
String encryptedRefreshToken = encrypt(refreshToken);
16

17
// Store encrypted access token in HttpOnly cookie
18
Cookie accessTokenCookie = new Cookie("accessToken", encryptedAccessToken);
19
accessTokenCookie.setMaxAge(expiresIn - 60); // Subtract 60s buffer for clock skew (seconds in Spring)
20
accessTokenCookie.setHttpOnly(true); // Prevents JavaScript access to mitigate XSS attacks
21
accessTokenCookie.setSecure("production".equals(env.getActiveProfiles()[0])); // HTTPS-only in production
22
accessTokenCookie.setPath("/"); // Available on all routes
23
response.addCookie(accessTokenCookie);
24
response.setHeader("Set-Cookie",
25
  response.getHeader("Set-Cookie") + "; SameSite=Strict"); // Prevents CSRF attacks
26

27
// Store encrypted refresh token in separate HttpOnly cookie
28
Cookie refreshTokenCookie = new Cookie("refreshToken", encryptedRefreshToken);
29
refreshTokenCookie.setHttpOnly(true); // Prevents JavaScript access to mitigate XSS attacks
30
refreshTokenCookie.setSecure("production".equals(env.getActiveProfiles()[0])); // HTTPS-only in production
31
refreshTokenCookie.setPath("/"); // Available on all routes
32
response.addCookie(refreshTokenCookie);

Check the session before handling requests

Session middleware refreshes sk_session and redirects to /login when the session is missing. A missing session returns 302, not JSON 401.

Express
Next.js

Guard a route with auth.requiresAuth. On success, req.scalekitUser is access-token claims. sub is always present.

1
app.get('/account', auth.requiresAuth, (req, res) => {
2
  res.json({ sub: req.scalekitUser?.sub });
3
});

Wrap a Route Handler with withAuth. Use createMiddleware() so every other path fails closed. List public paths in publicRoutes.

1
import { auth } from '../../lib/auth';
2

3
export const GET = auth.withAuth(async (request, { user }) => {
4
  return Response.json({ sub: user?.sub });
5
});

1
import { auth } from './lib/auth';
2

3
export default auth.createMiddleware({
4
  publicRoutes: ['/', '/pricing'],
5
});
6

7
export const config = {
8
  runtime: 'nodejs',
9
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
10
};

Flask
FastAPI

Guard a view with @auth.requires_auth. auth.current_user is access-token claims.

1
@app.route("/account")
2
@auth.requires_auth
3
def account():
4
    return {"sub": auth.current_user["sub"]}

Protect a route with Depends(auth.requires_auth). The dependency is the user claims.

1
from fastapi import Depends
2

3
@app.get("/account")
4
async def account(user: dict = Depends(auth.requires_auth)):
5
    return {"sub": user["sub"]}


5 collapsed lines
1
import (
2
  "net/http"
3
  "os"
4
  "github.com/gin-gonic/gin"
5
)
6
func VerifyToken() gin.HandlerFunc {
7
  return func(c *gin.Context) {
8
    // Extract encrypted tokens from request cookies
9
    accessToken, err := c.Cookie("accessToken")
10
    if err != nil || accessToken == "" {
11
      c.JSON(http.StatusUnauthorized, gin.H{"error": "Authentication required"})
12
      c.Abort()
13
      return
14
    }
15

16
    // Decrypt the access token before validation
17
    decryptedAccessToken := decrypt(accessToken)
18

19
    // Verify token validity using Scalekit's validation method
20
    isValid, err := scalekitClient.ValidateAccessToken(c.Request.Context(), decryptedAccessToken)
21

22
    if (err != nil || !isValid) {
23
      // Token expired - attempt transparent refresh
24
      refreshToken, err := c.Cookie("refreshToken")
25
      if err == nil && refreshToken != "" {
26
        decryptedRefreshToken := decrypt(refreshToken)
27
        authResult, err := scalekitClient.RefreshAccessToken(c.Request.Context(), decryptedRefreshToken)
28

29
        if err == nil {
30
          // Encrypt and store new tokens
31
          c.SetSameSite(http.SameSiteStrictMode)
32
          c.SetCookie(
33
            "accessToken",
34
            encrypt(authResult.AccessToken),
35
            authResult.ExpiresIn-60,
36
            "/",
37
            "",
38
            os.Getenv("GIN_MODE") == "release",
39
            true,
40
          )
41
          c.SetCookie(
42
            "refreshToken",
43
            encrypt(authResult.RefreshToken),
44
            0,
45
            "/",
46
            "",
47
            os.Getenv("GIN_MODE") == "release",
48
            true,
49
          )
50
          c.Next()
51
          return
52
        }
53
      }
54

55
      c.JSON(http.StatusUnauthorized, gin.H{"error": "Session expired. Please sign in again."})
56
      c.Abort()
57
      return
58
    }
59

60
    // Token is valid, proceed to the next handler in the chain
61
    c.Next()
62
  }
63
}


5 collapsed lines
1
import javax.servlet.http.HttpServletRequest;
2
import javax.servlet.http.HttpServletResponse;
3
import javax.servlet.http.Cookie;
4
import org.springframework.web.servlet.HandlerInterceptor;
5
import org.springframework.core.env.Environment;
6

7
/**
8
 * Intercepts HTTP requests to verify authentication tokens.
9
 * Transparently refreshes expired tokens to maintain user sessions.
10
 */
11
@Component
12
public class AuthInterceptor implements HandlerInterceptor {
13
  @Autowired
14
  private Environment env;
15

16
  @Override
17
  public boolean preHandle(
18
    HttpServletRequest request,
19
    HttpServletResponse response,
20
    Object handler
21
  ) throws Exception {
7 collapsed lines
22
    // Extract encrypted tokens from cookies
23
    String accessToken = getCookieValue(request, "accessToken");
24
    String refreshToken = getCookieValue(request, "refreshToken");
25

26
    if (accessToken == null) {
27
      response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
28
      response.getWriter().write("{\"error\": \"Authentication required\"}");
29
      return false;
30
    }
31

32
    try {
33
      // Decrypt the access token before validation
34
      String decryptedAccessToken = decrypt(accessToken);
35

36
      // Verify token validity using Scalekit's validation method
37
      boolean isValid = scalekitClient.validateAccessToken(decryptedAccessToken);
38

39
      if (!isValid && refreshToken != null) {
40
        // Token expired - refresh it transparently
41
        String decryptedRefreshToken = decrypt(refreshToken);
42
        AuthResult authResult = scalekitClient.authentication().refreshToken(decryptedRefreshToken);
43

44
        // Encrypt and store new tokens
20 collapsed lines
45
        Cookie accessTokenCookie = new Cookie("accessToken", encrypt(authResult.getAccessToken()));
46
        accessTokenCookie.setMaxAge(authResult.getExpiresIn() - 60);
47
        accessTokenCookie.setHttpOnly(true);
48
        accessTokenCookie.setSecure("production".equals(env.getActiveProfiles()[0]));
49
        accessTokenCookie.setPath("/");
50
        response.addCookie(accessTokenCookie);
51

52
        Cookie refreshTokenCookie = new Cookie("refreshToken", encrypt(authResult.getRefreshToken()));
53
        refreshTokenCookie.setHttpOnly(true);
54
        refreshTokenCookie.setSecure("production".equals(env.getActiveProfiles()[0]));
55
        refreshTokenCookie.setPath("/");
56
        response.addCookie(refreshTokenCookie);
57
        response.setHeader("Set-Cookie", response.getHeader("Set-Cookie") + "; SameSite=Strict");
58

59
        return true;
60
      }
61

62
      if (!isValid) {
63
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
64
        response.getWriter().write("{\"error\": \"Session expired. Please sign in again.\"}");
65
        return false;
66
      }
67

68
      // Token is valid, allow request to proceed
69
      return true;
70
    } catch (Exception e) {
71
      response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
72
      response.getWriter().write("{\"error\": \"Authentication failed\"}");
73
      return false;
74
    }
75
  }
76

77
  private String getCookieValue(HttpServletRequest request, String cookieName) {
78
    Cookie[] cookies = request.getCookies();
79
    if (cookies != null) {
80
      for (Cookie cookie : cookies) {
81
        if (cookieName.equals(cookie.getName())) {
82
          return cookie.getValue();
83
        }
84
      }
85
    }
86
    return null;
87
  }
88
 }

Build it yourself — store cookies and call validateAccessToken

Use this path when you do not use session middleware. Request offline_access so you receive a refresh token. Scalekit rotates refresh tokens. Store the new refresh token and discard the old one.

Store the access token in an HttpOnly cookie. Store the refresh token in a separate HttpOnly cookie. Encrypt both values.

1
const { accessToken, expiresIn, refreshToken } = authResult;
2
res.cookie('accessToken', encrypt(accessToken), {
3
  maxAge: (expiresIn - 60) * 1000,
4
  httpOnly: true,
5
  secure: process.env.NODE_ENV === 'production',
6
  sameSite: 'lax',
7
});
8
res.cookie('refreshToken', encrypt(refreshToken), {
9
  httpOnly: true,
10
  secure: process.env.NODE_ENV === 'production',
11
  sameSite: 'lax',
12
});

1
async function verifyToken(req, res, next) {
2
  const { accessToken, refreshToken } = req.cookies;
3
  if (!accessToken) {
4
    return res.status(401).json({ error: 'Authentication required' });
5
  }
6
  const decryptedAccessToken = decrypt(accessToken);
7
  const isValid = await scalekit.validateAccessToken(decryptedAccessToken);
8
  if (!isValid && refreshToken) {
9
    const authResult = await scalekit.refreshAccessToken(decrypt(refreshToken));
10
    res.cookie('accessToken', encrypt(authResult.accessToken), {
11
      maxAge: (authResult.expiresIn - 60) * 1000,
12
      httpOnly: true,
13
      secure: process.env.NODE_ENV === 'production',
14
      sameSite: 'lax',
15
    });
16
    res.cookie('refreshToken', encrypt(authResult.refreshToken), {
17
      httpOnly: true,
18
      secure: process.env.NODE_ENV === 'production',
19
      sameSite: 'lax',
20
    });
21
    return next();
22
  }
23
  if (!isValid) {
24
    return res.status(401).json({ error: 'Session expired. Please sign in again.' });
25
  }
26
  next();
27
}

1
import os
2
from functools import wraps
3
from flask import request, jsonify, make_response
4

5
def verify_token(f):
6
    @wraps(f)
7
    def decorated_function(*args, **kwargs):
8
        access_token = request.cookies.get("accessToken")
9
        refresh_token = request.cookies.get("refreshToken")
10
        if not access_token:
11
            return jsonify({"error": "Authentication required"}), 401
12
        is_valid = scalekit_client.validate_access_token(decrypt(access_token))
13
        if not is_valid and refresh_token:
14
            auth_result = scalekit_client.refresh_access_token(decrypt(refresh_token))
15
            response = make_response(f(*args, **kwargs))
16
            response.set_cookie(
17
                "accessToken",
18
                encrypt(auth_result.access_token),
19
                max_age=auth_result.expires_in - 60,
20
                httponly=True,
21
                secure=os.environ.get("FLASK_ENV") == "production",
22
                samesite="Lax",
23
            )
24
            response.set_cookie(
25
                "refreshToken",
26
                encrypt(auth_result.refresh_token),
27
                httponly=True,
28
                secure=os.environ.get("FLASK_ENV") == "production",
29
                samesite="Lax",
30
            )
31
            return response
32
        if not is_valid:
33
            return jsonify({"error": "Session expired. Please sign in again."}), 401
34
        return f(*args, **kwargs)
35
    return decorated_function

TypeScript: get typed claims from validateToken

Use a generic type parameter to get properly typed claims instead of unknown. Pass JWTPayload from jose for access tokens, or IdTokenClaim from @scalekit-sdk/node for ID tokens:

1
import type { JWTPayload } from 'jose';
2
import type { IdTokenClaim } from '@scalekit-sdk/node';
3

4
// Access token — typed as JWTPayload
5
const claims = await scalekit.validateToken<JWTPayload>(accessToken);
6
console.log(claims.sub); // user ID
7

8
// ID token — typed with full user profile claims
9
const idClaims = await scalekit.validateToken<IdTokenClaim>(idToken);
10
console.log(idClaims.email);

Configure session security and duration
Section titled “Configure session security and duration”

Manage user session behavior directly from your Scalekit dashboard without modifying application code. Configure session durations and authentication frequency to balance security and user experience for your application.

In your Scalekit dashboard, the Session settings page lets you set these options:
- Absolute session timeout: This is the maximum time a user can stay signed in, no matter what. After this time, they must log in again. For example, if you set it to 30 minutes, users will be logged out after 30 minutes, even if they are still using your app.
- Idle session timeout: This is the time your app waits before logging out a user who is not active. If you turn this on, the session will end if the user does nothing for the set time. For example, if you set it to 10 minutes, and the user does not click or type for 10 minutes, they will be logged out.
- Access token lifetime: This is how long an access token is valid. When it expires, your app needs to get a new token (using the refresh token) so the user can keep using the app without logging in again. For example, if you set it to 5 minutes, your app will need to refresh the token every 5 minutes.
Shorter timeouts provide better security, while longer timeouts reduce authentication interruptions.

If specific enterprise customers require stricter session timeouts than your application defaults, you can override the absolute and idle session timeouts on a per-organization basis. See Organization session policy to configure custom policies for individual organizations.

Manage sessions remotely API

Beyond client-side session management, Scalekit provides powerful APIs to manage user sessions remotely from your backend application. This enables you to build features like active session management in user account settings, security incident response, or administrative session control.

These APIs are particularly useful for:

Displaying all active sessions in user account settings
Allowing users to revoke specific sessions from unfamiliar devices
Security incident response and suspicious session termination

1
// Get details for a specific session
2
const sessionDetails = await scalekit.session.getSession('ses_1234567890123456');
3

4
// List all sessions for a user with optional filtering
5
const userSessions = await scalekit.session.getUserSessions('usr_1234567890123456', {
6
  pageSize: 10,
7
  filter: {
8
    status: ['ACTIVE'], // Filter for active sessions only
9
    startTime: new Date('2025-01-01T00:00:00Z'),
10
    endTime: new Date('2025-12-31T23:59:59Z')
11
  }
12
});
13

14
// Revoke a specific session (useful for "Sign out this device" functionality)
15
const revokedSession = await scalekit.session.revokeSession('ses_1234567890123456');
16

17
// Revoke all sessions for a user (useful for "Sign out all devices" functionality)
18
const revokedSessions = await scalekit.session.revokeAllUserSessions('usr_1234567890123456');
19
console.log(`Revoked sessions for user`);

1
# Get details for a specific session
2
session_details = scalekit_client.sessions.get_session(session_id="ses_1234567890123456")
3

4
# List all sessions for a user with optional filtering
5
from google.protobuf.timestamp_pb2 import Timestamp
6
from datetime import datetime
7

8
start_time = Timestamp()
9
start_time.FromDatetime(datetime(2025, 1, 1))
10
end_time = Timestamp()
11
end_time.FromDatetime(datetime(2025, 12, 31))
12

13
filter_obj = scalekit_client.sessions.create_session_filter(
14
    status=["ACTIVE"], start_time=start_time, end_time=end_time
15
)
16
user_sessions = scalekit_client.sessions.get_user_sessions(
17
    user_id="usr_1234567890123456", page_size=10, filter=filter_obj
18
)
19

20
# Revoke a specific session (useful for "Sign out this device" functionality)
21
revoked_session = scalekit_client.sessions.revoke_session(session_id="ses_1234567890123456")
22

23
# Revoke all sessions for a user (useful for "Sign out all devices" functionality)
24
revoked_sessions = scalekit_client.sessions.revoke_all_user_sessions(user_id="usr_1234567890123456")
25
print(f"Revoked sessions for user")

1
// Get details for a specific session
2
sessionDetails, err := scalekitClient.Session().GetSession(ctx, "ses_1234567890123456")
3
if err != nil {
4
    log.Fatal(err)
5
}
6

7
// List all sessions for a user with optional filtering
8
// import "time", sessionsv1 "...", "google.golang.org/protobuf/types/known/timestamppb"
9
startTime, _ := time.Parse(time.RFC3339, "2025-01-01T00:00:00Z")
10
endTime, _ := time.Parse(time.RFC3339, "2025-12-31T23:59:59Z")
11
filter := &sessionsv1.UserSessionFilter{
12
    Status:    []string{"ACTIVE"}, // Filter for active sessions only
13
    StartTime: timestamppb.New(startTime),
14
    EndTime:   timestamppb.New(endTime),
15
}
16
userSessions, err := scalekitClient.Session().GetUserSessions(ctx, "usr_1234567890123456", 10, "", filter)
17
if err != nil {
18
    log.Fatal(err)
19
}
20

21
// Revoke a specific session (useful for "Sign out this device" functionality)
22
revokedSession, err := scalekitClient.Session().RevokeSession(ctx, "ses_1234567890123456")
23
if err != nil {
24
    log.Fatal(err)
25
}
26

27
// Revoke all sessions for a user (useful for "Sign out all devices" functionality)
28
revokedSessions, err := scalekitClient.Session().RevokeAllUserSessions(ctx, "usr_1234567890123456")
29
if err != nil {
30
    log.Fatal(err)
31
}
32
fmt.Printf("Revoked sessions for user")

1
// Get details for a specific session
2
SessionDetails sessionDetails = scalekitClient.sessions().getSession("ses_1234567890123456");
3

4
// List all sessions for a user with optional filtering
5
// import UserSessionFilter, Timestamp, Instant
6
UserSessionFilter filter = UserSessionFilter.newBuilder()
7
    .addStatus("ACTIVE")
8
    .setStartTime(Timestamp.newBuilder().setSeconds(Instant.parse("2025-01-01T00:00:00Z").getEpochSecond()).build())
9
    .setEndTime(Timestamp.newBuilder().setSeconds(Instant.parse("2025-12-31T23:59:59Z").getEpochSecond()).build())
10
    .build();
11
UserSessionDetails userSessions = scalekitClient.sessions().getUserSessions("usr_1234567890123456", 10, "", filter);
12

13
// Revoke a specific session (useful for "Sign out this device" functionality)
14
RevokeSessionResponse revokedSession = scalekitClient.sessions().revokeSession("ses_1234567890123456");
15

16
// Revoke all sessions for a user (useful for "Sign out all devices" functionality)
17
RevokeAllUserSessionsResponse revokedSessions = scalekitClient.sessions().revokeAllUserSessions("usr_1234567890123456");
18
System.out.println("Revoked sessions for user");

After you add the helper, open /account in the browser. A missing session goes to /login. After login, the browser returns to /account.

Session middleware validates sk_session on each request and refreshes it before expiry. If the refresh token is invalid, the helper sends the browser to /login.

Manage user sessions

Store the session

Check the session before handling requests

Configure session security and duration

Manage sessions remotely API