---
title: "List every signed-in device · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/session-list
updated: 2026-10-20
licence: "All rights reserved"
---

# List every signed-in device

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- Rule: Show each person their active sessions, with device, browser, approximate place, sign-in time and last activity, and mark the current one.
- How: Store sessions on the server, one row per sign-in. Give each row a public ID apart from the secret cookie value, so the list never shows a secret. At sign-in, save a label parsed from the user agent, such as "Firefox on Windows". Save a city or country derived from the IP address, not the address. Update last activity at most once every 5 minutes, to save writes. With tokens, keep one row per refresh token family.
- Check: Sign in from two browsers. The list in each shows both, with the right browser names, and marks the current one.

Example:

```sql
CREATE TABLE sessions (
  id uuid PRIMARY KEY,
  secret_hash bytea NOT NULL UNIQUE,
  user_id uuid NOT NULL REFERENCES users (id) ON DELETE CASCADE,
  device_label text NOT NULL,
  approximate_place text,
  created_at timestamptz NOT NULL DEFAULT now(),
  last_seen_at timestamptz NOT NULL DEFAULT now()
);
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/session-list`.

- Next: [Let people sign out of one device or all of them](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/revoke-sessions)
- [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)