---
title: "End sessions and inspect sign-in events"
description: "Review session lifetime, revoke sessions and identify authentication audit events."
canonical_url: "https://docs.oz0.ai/admin/sign-in/sessions"
---
# End sessions and inspect sign-in events

> Review session lifetime, revoke sessions and identify authentication audit events.

For: cluster and tenant administrators.

Review session lifetime, revoke sessions and identify authentication audit events.

## Sessions

A session lasts seven days, whichever way it signed in, the CLI's too. *Access*, *Sessions* lists every signed-in browser, how it signed in, from which address and when it was last used; everyone sees their own under *Settings*, *Account*.

```bash [Terminal]
oz0 user sessions          # everyone's
oz0 user sessions kim
oz0 user signout kim       # every session of kim's
oz0 user signout kim --session 3f9a0c...
```

Changing a password, removing it, resetting the second step, disabling the account and removing it all sign the account out everywhere.

- The session cookie is this host's alone. It is `__Host-oz0_session`: browsers keep it only from this server over HTTPS, for every path, and no other host of the same site (another subdomain) can set or replace it. It is HttpOnly and SameSite=Strict. A request it signs that can change something must have a JSON or protobuf body, and when the browser says where it came from (`Sec-Fetch-Site`, or else `Origin`), it must come from this server's own pages; anything else is refused with 403. After an upgrade to this cookie, everyone signs in again once.

## In the audit log

Sign-in changes are in the [audit log](https://docs.oz0.ai/getting-started/web-ui): `user.create` (a password account, by whoever made it), `user.password.set` (who set it, whether it was the account's own change, and whether it was generated; never the password), `user.password.remove`, `oidc.provider.set` and `oidc.provider.remove`, `mfa.policy` (in the tenant's log for a tenant's policy), `mfa.enrol`, `mfa.disable`, `mfa.reset`, `mfa.recovery_codes` and `mfa.lockout`, `session.end`, `user.link.allow` and `user.unlink`, and what a provider did at a sign-in, as `oidc:<id>`: `user.create`, `user.link`, `user.role`, `member.set` and `member.remove`.

Accounts from a directory add `account.create`, `account.groups`, `account.disable`, `account.enable` and `account.removed`, with `member.remove`, `apikey.revoke` and `apikey.finding` in each tenant's log, as the provisioner or admin who made the call (`provisioner:<name>`), and `provisioner.tenant.allow` and `provisioner.tenant.remove` in the tenant's log; a provisioner's own entries are `provisioning.*`, and its certificates' `provisioner.issue`, `provisioner.renew`, `provisioner.disable` and `provisioner.enable`.

MCP clients add `mcp.client.authorized` and `mcp.client.denied` (the person's decision at the consent page, with the client and its redirect host), `mcp.client.revoked` (by the person, an admin, the client itself, or the server when a code or a refresh token was used twice) and `tenant.mcp_clients` (the allowlist).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.