Session ended unexpectedly
Why you were signed out, or an application lost access, and how to tell which event ended the session.
On this page
Symptom#
- You are asked to sign in again although you did not sign out.
- A page says Your session on this browser has ended. with Sign in again.
- An application you use stops working, or a refresh fails with
invalid_grant. - A sign-in you started is stopped with This sign-in has ended.
Likely causes#
A session is a record on identity that a browser is signed in. When it ends, the applications that signed in through it lose their refresh tokens. These are the events that end one.
| Event | What it ends |
|---|---|
| The session was idle too long | Default 12 hours with no activity. The platform can set this shorter, never longer. |
| The session reached its absolute limit | Default 14 days after sign-in, whatever you did meanwhile. The platform can set this shorter, never longer. |
| An organization's own limits | An organization can set shorter lifetimes, which apply when you sign in for it. An organization inside another one can only tighten its parent's limits, never loosen them. It can also cap how many sessions one account may hold at once, and the oldest sessions end when the cap is passed. |
| You switched organization in the account area | The session you left ends and a new one opens in the organization you chose, unless an application still depends on the old one. |
| You or someone with your session ended it | Sign out in the account, Sign out on a row of Devices, or Sign out everywhere. |
| A password change, a passkey removal or an authenticator reset | Every other session and its refresh tokens end. The session that made the change stays. |
| A session opened with the lost-passkey email code | It is one level lower than a passkey and cannot end other sessions, leave organizations or accept or decline invitations until a passkey or authenticator code is used on it. It is not remembered on the device, so it ends with the browser's normal limits. |
| You answered a sign-in alert | No, sign that session out ends the alerted session and the ones the same browser opened since. No, secure my account ends every session. |
| An email change was reverted from the old address | Everything is signed out. |
| The account was closed or deactivated | Every session and token is revoked at once. |
| The account or its organization was suspended | The session is refused on the next request. |
| An organization requires single sign-on | The session does not end, but an application's code redemption, refresh or token exchange for that organization is answered insufficient_user_authentication until you sign in through the organization's provider again. This applies only where the platform has turned on sso_enforcement (default OFF). |
| A refresh token was reused | If a retired refresh token is presented again after a 10-second grace window, identity revokes the whole token family and ends the session, and the account owner is emailed. |
| The application's own session | Your application keeps its own session as well. Identity ending a session does not delete your application's cookie; the application learns it ended through back-channel logout or at its next token refresh. |
An open account page checks regularly whether its own session still exists, so a session you end from another browser stops working there too.
What to check#
- Open Devices in your account, on the Sessions tab. Look at Signed in, Last active and Expires for your sessions. Idle timeout shows when an unused session would end, Sign-in method and Assurance show how it was opened, and Signed in to lists the applications that session signed in to. A Company sign-in entry means the session is pinned to your organization's connection. A short list with a recent Signed in time tells you the older ones ended.
- Open the notifications in your account and your email for security notices. A sign-in alert, a changed password or a removed passkey ends other sessions.
- Think about how long the browser sat unused. More than 12 hours idle ends a session by default.
- For an application, check whether the refresh failed with
invalid_grant. See invalid_grant. - If several people in one organization lose sessions at the same time, ask the organization's administrators whether session lifetimes or limits changed.
Fix#
- Sign in again. This is the normal way back, and it starts a new session.
- Use a passkey to make signing in quick. See Security and passkeys.
- If you did not cause it and did not expect it, treat it as a security event: check Devices for sessions you do not recognise, change your password, and review your passkeys and your connected apps. See Sessions and devices.
- Ticking "Keep me signed in on this device" is offered only where available and only on a device you control. It is still bounded by a ceiling, so you will sign in again sooner or later.
- For an application, treat the end of a session as a normal event: when a refresh fails, send the person through sign-in again instead of retrying. Handle back-channel logout so your own session ends at the same time; see Back-channel logout.