List and Revoke Your Account Sessions — Sessions API

Session management gives you full visibility and control over every active login on your account. You can list all sessions ordered newest first, revoke a specific session by its public ID, or sign out from every device except the one you are currently using. All three operations require an active session cookie, and state-changing requests additionally require an x-csrf-token header.

List Active Sessions

Retrieve all active sessions for your account, ordered newest first. Each session entry includes its public ID and timestamps you can display in a “Devices” or “Active Sessions” UI.

Endpoint

GET https://api.example.com/api/v1/auth/sessions

Example Request

curl -X GET https://api.example.com/api/v1/auth/sessions \
  -b cookies.txt

const response = await fetch(
  "https://api.example.com/api/v1/auth/sessions",
  { credentials: "include" }
);
const { data } = await response.json();
// data is an array of session objects

resp = session.get("https://api.example.com/api/v1/auth/sessions")
sessions = resp.json()["data"]

Success Response — `200 OK`

{
  "success": true,
  "data": [
    {
      "public_id": "ses_01H",
      "created_at": "2024-06-15T10:23:00Z",
      "expires_at": "2024-07-15T10:23:00Z"
    },
    {
      "public_id": "ses_02H",
      "created_at": "2024-06-10T08:00:00Z",
      "expires_at": "2024-07-10T08:00:00Z"
    }
  ]
}

array

Show Session object fields

string

Unique public identifier for the session, prefixed ses_. Use this to revoke a specific session.

string (ISO 8601)

Timestamp when the session was created (i.e., when the user logged in).

string (ISO 8601)

Timestamp when the session will automatically expire.

Revoke a Specific Session

Revoke any single session by its public ID. If the revoked session happens to be the one making the request, the server also clears the session cookie in the response.

Endpoint

DELETE https://api.example.com/api/v1/auth/sessions/{session_public_id}

Path Parameter

string

required

The public_id of the session to revoke, e.g. ses_01H. Obtain this from the GET /auth/sessions response.

Example Request

# Step 1 — get CSRF token
CSRF=$(curl -s -b cookies.txt \
  https://api.example.com/api/v1/auth/csrf-token \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['csrf_token'])")

# Step 2 — revoke session ses_02H
curl -i -X DELETE https://api.example.com/api/v1/auth/sessions/ses_02H \
  -b cookies.txt \
  -H "x-csrf-token: $CSRF"

const csrfRes = await fetch(
  "https://api.example.com/api/v1/auth/csrf-token",
  { credentials: "include" }
);
const { data: { csrf_token } } = await csrfRes.json();

await fetch(
  "https://api.example.com/api/v1/auth/sessions/ses_02H",
  {
    method: "DELETE",
    credentials: "include",
    headers: { "x-csrf-token": csrf_token },
  }
);

csrf_token = session.get(
    "https://api.example.com/api/v1/auth/csrf-token"
).json()["data"]["csrf_token"]

resp = session.delete(
    "https://api.example.com/api/v1/auth/sessions/ses_02H",
    headers={"x-csrf-token": csrf_token},
)
# 204 No Content

Success Response — `204 No Content`

The session is revoked. No response body is returned.

Error Responses

Status	Meaning	When it occurs
`401 Unauthorized`	Not authenticated	No valid session cookie was sent.
`404 Not Found`	Session not found	The `session_public_id` does not exist or does not belong to your account.

Revoke All Other Sessions

Sign out from every active session except the current one. This is the “sign out from all other devices” action.

Endpoint

DELETE https://api.example.com/api/v1/auth/sessions

Example Request

CSRF=$(curl -s -b cookies.txt \
  https://api.example.com/api/v1/auth/csrf-token \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['csrf_token'])")

curl -i -X DELETE https://api.example.com/api/v1/auth/sessions \
  -b cookies.txt \
  -H "x-csrf-token: $CSRF"

const csrfRes = await fetch(
  "https://api.example.com/api/v1/auth/csrf-token",
  { credentials: "include" }
);
const { data: { csrf_token } } = await csrfRes.json();

const response = await fetch(
  "https://api.example.com/api/v1/auth/sessions",
  {
    method: "DELETE",
    credentials: "include",
    headers: { "x-csrf-token": csrf_token },
  }
);
const data = await response.json();

csrf_token = session.get(
    "https://api.example.com/api/v1/auth/csrf-token"
).json()["data"]["csrf_token"]

resp = session.delete(
    "https://api.example.com/api/v1/auth/sessions",
    headers={"x-csrf-token": csrf_token},
)
print(resp.json())

Success Response — `200 OK`

{
  "success": true
}

Your current session remains active. All other sessions for your account are revoked and those devices will be required to log in again.

Error Responses

Status	Meaning	When it occurs
`401 Unauthorized`	Not authenticated	No valid session cookie was sent.

Use Revoke All Other Sessions after a password change or any time you suspect your account may have been accessed from an unknown device. Your current session stays active, so you remain logged in while every other browser and app is signed out immediately.

Logout

Revoke only the current session and clear your cookie.

Password Reset

Reset your password — this also revokes all sessions automatically.

Auth & Sessions

Account

Catalog

Cart & Checkout

Reviews

List and Revoke Your Account Sessions — Sessions API

List Active Sessions

Endpoint

Example Request

Success Response — `200 OK`

Revoke a Specific Session

Endpoint

Path Parameter

Example Request

Success Response — `204 No Content`

Error Responses

Revoke All Other Sessions

Endpoint

Example Request

Success Response — `200 OK`

Error Responses

Logout

Password Reset

​List Active Sessions

​Endpoint

​Example Request

​Success Response — 200 OK

​Revoke a Specific Session

​Endpoint

​Path Parameter

​Example Request

​Success Response — 204 No Content

​Error Responses

​Revoke All Other Sessions

​Endpoint

​Example Request

​Success Response — 200 OK

​Error Responses

​Related Endpoints

Logout

Password Reset

List Active Sessions

Endpoint

Example Request

Success Response — `200 OK`

Revoke a Specific Session

Endpoint

Path Parameter

Example Request

Success Response — `204 No Content`

Error Responses

Revoke All Other Sessions

Endpoint

Example Request

Success Response — `200 OK`

Error Responses

Related Endpoints