Sessions + devices
How sweetdocs sessions work, why you stay signed in, and the two sign-out paths: local-only or revoke everywhere across every device.
A sweetdocs session is the token that proves you’re signed in. Sessions live in the browser; they’re refreshed automatically as long as you’re using the app, and they persist across browser restarts unless you sign out.
This page covers how sessions work, why you don’t see a constant “sign in” prompt, and what to do if you suspect a session is compromised.
How sessions work
Sweetdocs uses Supabase Auth for session management:
| Aspect | Detail |
|---|---|
| Token type | JWT (signed by Supabase’s auth service) |
| Storage | The token lives in localStorage in your browser |
| Refresh | Tokens auto-refresh in the background as long as the tab is open; closed tabs hold the token until its refresh window |
| Cross-tab | Sessions are shared across tabs in the same browser (same localStorage) |
| Cross-device | Each device / browser has its own session — signing in on a phone doesn’t sign in your laptop |
The session persists across browser restarts. You only sign in again when:
- You explicitly sign out
- The refresh token expires (after a long inactivity gap)
- You sign out everywhere (revokes all sessions for the account)
Local sign-out
| Action | Effect |
|---|---|
| Profile menu → Sign out | Ends the session on this browser only |
supabase.auth.signOut() under the hood | Clears the localStorage token |
| Other devices | Stay signed in (their tokens are independent) |
Local sign-out is the right choice when you’re sharing a device (e.g., on a friend’s laptop) but want to leave the rest of your devices alone.
Sign out everywhere
| Action | Effect |
|---|---|
| Settings → Security → Sign out everywhere | Revokes every session on every device |
| Under the hood | supabase.auth.signOut({ scope: 'global' }) |
| Tokens elsewhere | Become invalid immediately — those devices show a sign-in screen on next request |
| Email notification | Sent to the account email confirming the action |
This is the post-compromise reset: if you think a phone, work laptop, or anything else has been left signed in somewhere you don’t trust, this is the kill switch.
What “everywhere” actually means
Sign-out everywhere revokes:
- Browser sessions on every device
- Mobile app sessions (when sweetdocs ships native mobile, sessions will be revoked from there too)
- API tokens issued via the auth path (not the separate “API keys” you might generate for programmatic access — those have their own revocation in API keys settings)
After sign-out-everywhere, you’ll need to sign in again on every device you want to use.
Concurrent sessions
A single user can have any number of concurrent sessions across devices. There’s no “kick the previous session” rule — your laptop, phone, and work computer can all be signed in simultaneously.
This is intentional for collaboration: each session opens its own real-time collab connection, with its own awareness presence. You and your “you” on another device show up as two cursors if both are editing.
Inactivity timeout
There’s no fixed inactivity timeout in v1 — sessions stay live as long as the refresh token is honored. Practical lifetime is on the order of weeks to a month before re-auth is required.
For higher-security needs (e.g., enterprise compliance), the Teams plan’s SSO flow inherits session policies from your IdP — Okta, Azure AD, etc. can enforce shorter idle timeouts.
Device list / session management UI
In v1 there’s no dedicated “see all my devices” UI. Two adjacent capabilities:
- Sign out everywhere — the bulk action
- Audit log — records sign-in events by timestamp (in orgs)
A per-device session list with selective revoke is on the roadmap.
Email confirmations
Major session-related actions trigger emails:
| Event | |
|---|---|
| Sign-up confirmation | Verify your email after creating a new account |
| Password reset link | Sent from the Forgot Password flow |
| Email change confirmation | Sent to both old and new emails (double-confirmation defense) |
| Sign-out everywhere | Notification email confirming the action |
If you receive a confirmation email you didn’t trigger, your account may have been targeted — sign out everywhere immediately and change your password.
What’s not in v1
| Missing | Notes |
|---|---|
| Per-device session list with names | Coming |
| Selective revoke (sign out that one device) | Coming |
| Last-active timestamp per session | Not in v1 |
| Device fingerprinting / suspicious-device alerts | Not in v1 |
| Hardware key (FIDO2 / WebAuthn) for sessions | Not in v1 (would arrive alongside 2FA) |