Signing in and devices
A browser session, tokens for apps, and how to cut off a device you lost.
Two ways in
In a browser, signing in creates a session held in a secure cookie, and signing out invalidates it immediately.
Apps and programmatic tools use tokens: a short-lived one for requests and a refresh token to obtain the next one. One row is kept per device.
A failed sign-in always says the same thing and never reveals whether the address or the password was wrong.
A refresh token works exactly once
Every refresh replaces both tokens. If a consumed refresh token is presented again — the classic sign of theft — that whole device is revoked.
It turns the worst case into one more sign-in rather than long, silent access.
Cutting off access
You can see your own devices and remove any of them. Changing your password cuts off all the others at once.
If an admin disables an account, that account's sessions and tokens stop working in that same moment — not when they would have expired.
Read this next
- Account & plansYour account and passwordWhat you change yourself, and what changing a password does to your other devices.
- Account & plansProgrammatic accessOne versioned API, with a contract that does not break a published version.
- Security & dataRate limits and error messagesWhy you are sometimes asked to wait, and the shape every error shares.
Still stuck?
If the answer wasn't here, write to us. It is a real inbox and it gets answered.