> ## Documentation Index
> Fetch the complete documentation index at: https://aidocs.ethanbragdon.icu/llms.txt
> Use this file to discover all available pages before exploring further.

# Sessions & Devices

> Understand Starfire AI session persistence, device visibility, revocation, and account-security controls.

# Sessions & devices

Starfire separates your account from the individual sessions used by browsers and devices. This makes it possible to revoke one session without deleting the account or changing unrelated organization resources.

## Session lifecycle

A successful authentication flow establishes a server-managed session. Depending on the sign-in options and security policy, that session can be short-lived or persistent.

A session can end because of:

* explicit sign-out
* manual revocation
* expiration
* password or security changes
* administrator action
* account suspension or security hold

## Device visibility

Starfire's identity system can associate sessions with device and client context so a user or authorized administrator can understand where an account is active.

Useful device information can include the client type, approximate last-active time, and session state. Device information is operational context—not proof that a specific human performed every action from that device.

## Revoke access

When a device is lost, shared unexpectedly, or no longer trusted, revoke its session rather than waiting for it to expire.

Authorized platform administrators can also revoke individual sessions, revoke broader account access, or require recovery actions when responding to a security event.

<Warning>
  Revoking a web session does not automatically revoke separate developer API keys, service-account credentials, or third-party integration secrets. Review those credentials separately when an account may be compromised.
</Warning>

## Live Sync and multi-device state

As Starfire's cross-device capabilities evolve, session and device state also provide the foundation for safe synchronization. A device losing authorization should no longer be treated as an active trusted client.

<Card title="Security overview" icon="shield-halved" href="/security/overview">
  Learn how user, organization, developer, and administrator access boundaries fit together.
</Card>