---
title: "Let people sign out of one device or all · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/revoke-sessions
updated: 2026-10-20
licence: "All rights reserved"
---

# Let people sign out of one device or all of them

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- Rule: Let people end any one session from the list, or every session but the current one. The ended sessions stop working on their next request.
- How: Delete the session row on the server. With cookie sessions that is enough, because the next request finds no row. With access tokens, revoke the refresh token, and keep access tokens at 15 minutes or less, as [verify every token](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/token-checks) says. Also check ended session IDs on each request until their access tokens expire, or an ended session keeps working for up to 15 minutes. Record each sign-out in the [security log](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/security-activity-log).
- Check: Sign in from two browsers. From the first, end the second session. The second browser's next request answers 401 or shows the sign-in page.

Example:

```js
app.post('/account/sessions/:id/end', requireUser, async (req, res) => {
  await db.none('DELETE FROM sessions WHERE id = $1 AND user_id = $2', [req.params.id, req.user.id]);
  await securityLog.append({ userId: req.user.id, type: 'session.ended', sessionId: req.params.id });
  res.redirect(303, '/account/sessions');
});
```

```python
@app.post("/account/sessions/<session_id>/end")
@login_required
def end_session(session_id: str):
    db.execute("DELETE FROM sessions WHERE id = %s AND user_id = %s", (session_id, current_user.id))
    security_log.append(user_id=current_user.id, type="session.ended", session_id=session_id)
    return redirect("/account/sessions", code=303)
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/revoke-sessions`.

- Previous: [List every signed-in device](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/session-list)
- Next: [End sessions when access changes](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/end-sessions-on-change)
- [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)