Skip to main content
Both live on the Devices & sessions tab of an employee’s record.

Sessions

Every place the employee is currently signed in, with when the session started. OnTime sessions are stateful: a signed session cookie is checked against a live session record on every request. Revoking one takes effect immediately, not when a token expires.

Revoke one

Ends a single session — a lost phone, a shared machine.

Sign out everywhere

Ends every session for that employee at once.

When to sign someone out everywhere

1

An employee is exiting

Do it as part of offboarding. Changing their status does not end their sessions.
2

You have just reduced someone's access

Editing a role takes effect immediately for permission checks, but the person stays signed in. If the change is urgent, revoke as well.
3

A device is lost

Revoke the session, and revoke the device.
Employees can also manage their own sessions from the Me tab of their app.

Devices

Devices enrolled to this employee, of two kinds: Each is Active or Revoked. Revoking is immediate.
A biometric device record is an association, not a hardware sync. It links a terminal’s user identity to this OnTime employee so their punches land on their day record. It does not push or pull fingerprint templates to or from the terminal — enrolling a finger is a physical action at the device.If terminal punches are not appearing for someone, the thing to check is the terminal user mapping, not this list. See the Biometric Terminals tab.

Auditing

Every session revocation and device change is written to the employee’s audit trail under the Devices category, with who did it and when.