Sign out and end sessions

A session is a browser or a script that is signed in to your account. Signing out ends the session in the browser you are using. To end every session at once, change your password.

• Sign in to the dashboard.

1. At the top right of the dashboard, select your initials.
2. Select Sign out.

You can also sign out from Settings: on the Security tab, the Sessions card has Sign out of this device. On coritan.com's own pages, Sign out is at the top of the page.

Signing out makes this browser forget its tokens. Coritan does not cancel them: a copy of a token taken from the browser keeps working until it expires. If you think someone has one, end every session.

1. In the sidebar, select Settings, then the Security tab.
2. Change your password.

Every token issued before the change stops working, the one in this browser included. Every browser and script then has to sign in again, with your new password and, if it is on, a code from your authenticator app. Resetting a forgotten password has the same effect.

Signing in gives a browser or a script two tokens:

Access token

Proves who you are on each request. It lasts a short time: 30 minutes unless Coritan changes the setting.

Refresh token

Gets a new pair of tokens when the access token runs out. It lasts 30 days unless Coritan changes the setting, and each new pair starts a new refresh token with a full lifetime.

The dashboard renews its tokens on its own, so a browser you use at least once within the refresh token's lifetime stays signed in until you sign out. A script does the same with POST /auth/refresh, as Make your first API request shows.

The browser you signed out of shows the sign-in page. After a password change, every other browser shows the sign-in page the next time it contacts Coritan, and scripts get 401 answers until they sign in again.

The Sessions card on the Security tab lists only the browser you are using, marked This device. Coritan keeps no list of your other sessions, so the dashboard cannot show them or end them one at a time.

The dashboard signed you out on its own

The refresh token expired, someone changed or reset the password, or Coritan suspended the account. If you did not change the password, reset it and turn on two-factor authentication.

A script gets 401 with Token invalidated by password change

The password changed after the script signed in. Sign it in again with the new password.

A script gets 403 with Account is suspended or closed

The account cannot be used. Contact support.

• Change or reset your password
• Turn on two-factor authentication
• Authentication

The API has no sign-out endpoint and no list of sessions. To end a script's session, delete its tokens. To end every session, change the password with POST /auth/me/password, as Change or reset your password shows: every earlier token then answers 401 with Token invalidated by password change.