Sessions and devices
One session per device, with its IP, single or bulk sign-out, IP blocking and CLI authorisation with a code.
- Category: Payments and administration
- Status: Available
- Requirements: An ArduMaker account
- MCP tools: No MCP tools: it is used from the dashboard.
What can you do with it?
- See each open session: client type, browser, platform, IP, last activity and whether it is the current one.
- Close a specific session or all but the current one.
- Block an IP for your own account, from the list or manually.
- Authorise the ArduMaker CLI on another machine with a short code.
When should you use it?
To review where the account is being used, cut off a lost or unknown device, or connect a terminal without typing the password on it.
How does it work in ArduMaker?
| Aspect | Without «remember me» | With «remember me» |
|---|---|---|
| Access token | 1 day | 12 h, renews itself |
| Refresh | None | Single-use, rotating token |
| Session end | When the token expires | 30 days unused or 180 days total |
- If an already used refresh token arrives, ArduMaker assumes it was stolen and cuts the whole session.
- Changing the password closes all other sessions.
- A blocked IP cannot log in or refresh on that account, and live sessions from it are cut. Unblocking does not revive what was cut.
- «Connected now» means activity in the last 5 minutes.
Authorising a device
- The CLI requests a code and shows a 6-character one.
- The person, signed in, confirms it on ArduMaker's
/binpage. - The CLI receives its own session, which shows up in the list as another device.
The code expires after 10 minutes. Authorising a device sends a security email to the account.
What actually changes?
Each login creates its own session with its initial IP. Closing or blocking it invalidates it on the server: the token stops working on the next request.
Expected result
The person controls which devices have the account open and can cut any of them instantly. Closed sessions remain visible with their reason.
Errors and troubleshooting
| Code | What happened |
|---|---|
refresh_token_reutilizado | A refresh token was reused: the session was cut and you must log in again. |
refresh_token_vencido | 30 days without using the session. |
ip_bloqueada | The IP is blocked for that account. |
demasiados_intentos | 10 failed refreshes in a minute from that IP; includes Retry-After. |
slow_down | The CLI requested codes or polled too fast. |
MCP access
There are no MCP tools for sessions. MCP agents are authorised through their own OAuth flow and do not appear as account sessions. See /mcp/docs.