Remote session termination
A user wants to sign out a previously used laptop or phone without accessing that device.
Better Auth · Module
revokeSession
revokeSession manually ends a specific Better Auth session by using its session token. It is useful for terminating a session from a signed-in device other than the one currently in use.
How it works
Call the client method with the token belonging to the session that should end. This provides a way to terminate a particular session manually, while broader methods handle other or all sessions.
Syntax
authClient.revokeSession({ token: string })Parameters
| Name | Type | Description |
|---|---|---|
token | string | The session token identifying the session to revoke. |
Key points
- Use
revokeSessionto manually terminate a selected session. - The target is selected by passing its session token.
- Normal sign-out already ends the session on that device.
- A signed-in device can manually end another session when its token is available.
- Enabling database preservation keeps the revoked session row rather than deleting it.
Common mistakes
- Revocation also removes the session from secondary storage; database preservation changes this behavior.
Example: Revoke a session
import { authClient } from "@/lib/auth-client";
await authClient.revokeSession({
token: "session-token",
});Pass the target session's token to revoke that session from a device where the user is signed in.
When to use it
Account security controls
An application provides a security screen listing active sessions and lets the user end one selected entry.
Incident response
A suspicious or compromised session must be invalidated after the user identifies its token.
Interview questions
QHow do you revoke one session?
Call authClient.revokeSession and provide an object containing the target session token. This manually ends that specific session from a device where the user is signed in.
Follow-up: How would you terminate every session instead? Use authClient.revokeSessions() rather than supplying one token.
QWhat input does revokeSession require?
The method identifies the session through its token, so the token must be passed in the token property. It is intended for ending a selected session manually.
Follow-up: How would you revoke every session except the current one? Call authClient.revokeOtherSessions().
QWhen would you use this method instead of sign-out?
Signing out already ends the session automatically, but revokeSession is useful when a user needs to end a session on another device. The caller supplies that session's token.
Follow-up: What persistence detail matters after revocation? With preserveSessionInDatabase enabled, the database row remains instead of being deleted.
Related
revokeOtherSessionsrevokeSessionspreserveSessionInDatabasesignOut