Managing Your Sessions
Every sign-in creates a session: one for each browser and one for each phone with the mobile app. Your profile gives you full visibility and one-click control over all of them, so you can see where your account is signed in, when each sign-in ends, and sign out anything you do not recognize.
This guide walks you through reading the list, understanding when a sign-in ends, and signing sessions out. For the underlying security model, see Authentication.
Where to Find Your Sessions
Your sessions live in your profile, under the security settings.
- Open the profile menu (top right) and choose Profile.
- Select the Security tab.
- Scroll to the Active Sessions card.
Open in Mirox
Jump straight to the tab: service.mirox.io/#/profile?tab=security.
The list shows only sign-ins that are still valid, sorted with the most recently active first. Ended ones drop off automatically.
Reading the Session List
Each row describes one active sign-in:
| Column | What it tells you |
|---|---|
| Device | The browser and operating system, the mobile app, a recognized API client (for scripts and tools), or Unknown client when the software could not be identified. |
| Location | The approximate city and country, with the country flag. |
| IP Address | The public IP the session is connecting from. |
| Last active | A live Online indicator if the session was used within the last few minutes, otherwise how long ago it was last used. |
| Expires | When this sign-in ends on its own if you do nothing. |
Your current session, the one you are using right now, is marked and has no revoke action.
Info
A row labelled Unknown client simply means the connecting software did not identify itself in a way the platform recognizes (common for command-line tools and scripts). It is not, by itself, a sign of compromise. It is the kind of entry worth checking against your own activity.
Browser and Mobile App
A sign-in in a browser and a sign-in in the mobile app are separate sessions, and each has its own row. Above the list, the App devices card shows the phones that run the Mirox mobile app, with their notification and update status. You can sign a phone out from either card with Revoke.
When a Sign-In Ends
A sign-in does not last forever. How long it lasts is set by your organization, separately for the web app and for the mobile app. If your organization has set a 2FA re-check interval, with 2FA on your account (an authenticator app or a passkey) you also sign in again a set time after you last proved your second factor. If your organization has set nothing, or you belong to no organization, the Mirox defaults apply. They are listed under Platform Defaults.
When the time is up you are signed out and sign in again: with your password, and with your code or your passkey if you have two-factor authentication. There is no in-between state. You are either signed in or you are not.
Your organization's Admins and Moderators can change these values. See Organization Security Policy.
The Countdown in the Header
In the browser, Mirox tells you before a sign-in ends: during the last 24 hours a countdown appears in the header. What follows is described under What You See When a Sign-In Ends.
Save Before the Countdown Ends
Text you typed into a form and did not save is lost when the sign-in ends. Save your work before the countdown reaches zero.
When Your Organization Changes Its Rules
An organization can change its rules at any time, and sign-ins that are already running follow the new rules. If the rules get stricter, a sign-in that is now too old ends a short time after the change. Open browser tabs show a warning first. See When You Change the Rules.
You follow the rules of your organization from the moment you join it. Rules about sign-in duration are never passed on to a cooperation partner: when you work on a partner's plants, your own organization's durations still apply.
What a Sign-In's End Does Not Touch
- Alarm notifications keep arriving by email, push, Telegram and webhook. They also arrive on a phone whose sign-in has ended and is waiting for a new sign-in. If you sign out in the app yourself, push to that phone stops; your other channels keep delivering.
- API tokens keep working. They have their own expiration date.
- Your VPN profile keeps working. It is based on a certificate, not on a sign-in.
Signing Out a Single Session
If you spot a session you do not recognize, or you forgot to sign out on a shared or lost device, end it from here:
- Find the session row.
- Click Revoke.
The session stops working immediately. The next request from that browser or app is rejected and it shows the sign-in page. Device pages opened through the Proxy from that session close with it: the next request is refused, and a live stream that is already open is closed within about a minute.
Signing Out Everywhere Else
To sign out of every other browser and app in one step while keeping your current session active:
- Click Revoke All at the top of the Active Sessions card.
- Confirm in the dialog. It tells you how many other sessions will be ended.
Your current session stays signed in. All others are ended at once, including the mobile app on your phone. This is the fastest response if you suspect your account has been used somewhere you did not authorize.
Warning
Changing your password also signs out every other session automatically. Completing a password reset signs you out everywhere, including the current browser and the mobile app. If you reset your password, expect to sign in again afterwards.
Good Security Hygiene
- Review regularly — glance over your active sessions from time to time, especially the location and last-active columns, to confirm everything is yours.
- Sign out on shared devices — after using a public or shared computer, sign out there, or revoke that session from here.
- Act on the unexpected — if a session shows an unfamiliar location or device, revoke it, then change your password and review your audit log for any access to your plants.
- Add a second factor — two-factor authentication means a stolen password alone cannot start a new session.
- Watch your sign-in alerts — Mirox emails you when a sign-in comes from a network address that is new for your account. A new browser on a connection you have used before does not send an alert. Treat an alert you cannot explain the same way you would an unexpected session.
Related Guides
- Authentication — how sign-in, sessions, and remote sign-out work behind the scenes
- Organization Security Policy — the rules an organization can set for sign-in duration and 2FA
- Setting Up Two-Factor Authentication — add a second proof of identity so a password alone is not enough
- Account Security FAQ — short answers on sign-outs, missing plants and lost authenticators
- Audit Log — the immutable record of who accessed your plants and devices
- Permission System — what an identity is allowed to reach once it is signed in