# Sessions and devices

One session per device, with its IP, single or bulk sign-out, IP blocking and CLI authorisation with a code.

Source: https://ardumaker.com/en/docs/sesiones-y-dispositivos/

- Category: Payments and administration
- Status: Available
- Requirements: An ArduMaker account
- MCP tools: No MCP tools: it is used from the dashboard.

## What can you do with it?

- See each open session: client type, browser, platform, IP, last activity and whether it is the current one.
- Close a specific session or all but the current one.
- Block an IP for your own account, from the list or manually.
- Authorise the ArduMaker CLI on another machine with a short code.

## When should you use it?

To review where the account is being used, cut off a lost or unknown device, or connect a terminal without typing the password on it.

## How does it work in ArduMaker?

| Aspect | Without «remember me» | With «remember me» |
| --- | --- | --- |
| Access token | 1 day | 12 h, renews itself |
| Refresh | None | Single-use, rotating token |
| Session end | When the token expires | 30 days unused or 180 days total |

- If an already used refresh token arrives, ArduMaker assumes it was stolen and cuts the whole session.
- Changing the password closes all other sessions.
- A blocked IP cannot log in or refresh on that account, and live sessions from it are cut. Unblocking does not revive what was cut.
- «Connected now» means activity in the last 5 minutes.

### Authorising a device

1. The CLI requests a code and shows a 6-character one.
2. The person, signed in, confirms it on ArduMaker's `/bin` page.
3. The CLI receives its own session, which shows up in the list as another device.

The code expires after 10 minutes. Authorising a device sends a security email to the account.

## What actually changes?

Each login creates its own session with its initial IP. Closing or blocking it invalidates it on the server: the token stops working on the next request.

## Expected result

The person controls which devices have the account open and can cut any of them instantly. Closed sessions remain visible with their reason.

## Errors and troubleshooting

| Code | What happened |
| --- | --- |
| `refresh_token_reutilizado` | A refresh token was reused: the session was cut and you must log in again. |
| `refresh_token_vencido` | 30 days without using the session. |
| `ip_bloqueada` | The IP is blocked for that account. |
| `demasiados_intentos` | 10 failed refreshes in a minute from that IP; includes `Retry-After`. |
| `slow_down` | The CLI requested codes or polled too fast. |

## MCP access

There are no MCP tools for sessions. MCP agents are authorised through their own OAuth flow and do not appear as account sessions. See [/mcp/docs](https://ardumaker.com/en/mcp/docs).

## Related features

- [External sign-in](https://ardumaker.com/en/docs/autenticacion-externa/)
- [Notifications](https://ardumaker.com/en/docs/notificaciones/)
- [MCP server](https://ardumaker.com/en/docs/servidor-mcp/)
- [MCP agent permissions](https://ardumaker.com/en/docs/permisos-mcp/)