> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ontime.hosai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Sessions and devices

> See where an employee is signed in, revoke sessions, and manage the devices enrolled to them.

export const PermissionNote = ({perm}) => <Info>
    Requires the <code>{perm}</code> permission. Ask your administrator if an
    action described here is missing from your screen — see
    [Roles & permissions](/help/concepts/roles-and-permissions).
  </Info>;

<PermissionNote perm="device:read" />

Both live on the **Devices & sessions** tab of an employee's record.

## Sessions

Every place the employee is currently signed in, with when the session started.

OnTime sessions are **stateful**: a signed session cookie is checked against a live session record on every request. Revoking one takes effect immediately, not when a token expires.

<CardGroup cols={2}>
  <Card title="Revoke one" icon="log-out">
    Ends a single session — a lost phone, a shared machine.
  </Card>

  <Card title="Sign out everywhere" icon="power">
    Ends every session for that employee at once.
  </Card>
</CardGroup>

### When to sign someone out everywhere

<Steps>
  <Step title="An employee is exiting">
    Do it as part of offboarding. Changing their status does not end their sessions.
  </Step>

  <Step title="You have just reduced someone's access">
    Editing a role takes effect immediately for permission checks, but the person stays signed in. If the change is urgent, revoke as well.
  </Step>

  <Step title="A device is lost">
    Revoke the session, and revoke the device.
  </Step>
</Steps>

Employees can also manage their own sessions from the **Me** tab of their app.

## Devices

<PermissionNote perm="device:write" />

Devices enrolled to this employee, of two kinds:

| Kind        | Meaning                                             |
| ----------- | --------------------------------------------------- |
| `Mobile`    | A phone the employee has used.                      |
| `Biometric` | An association with a biometric terminal enrolment. |

Each is `Active` or `Revoked`. Revoking is immediate.

<Note>
  **A biometric device record is an association, not a hardware sync.** It links a terminal's user identity to this OnTime employee so their punches land on their day record. It does **not** push or pull fingerprint templates to or from the terminal — enrolling a finger is a physical action at the device.

  If terminal punches are not appearing for someone, the thing to check is the **terminal user mapping**, not this list. See the **Biometric Terminals** tab.
</Note>

## Auditing

Every session revocation and device change is written to the employee's audit trail under the Devices category, with who did it and when.