> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# Sessions and Tokens

Read the current auth session, list a user's active sessions, and revoke one, all, or every other session — plus fetch and refresh access tokens.

## Get the current session

`GET /iam/v2/auth/get-session`

### Query parameters

- `disableCookieCache` `boolean`: Disable cookie cache and fetch session from database

### Responses

#### `200`: Success

Body (`application/json`):

- `session` `object` _(required)_: The session that was created or looked up.
  - `id` `string` _(required)_: The session ID.
  - `expiresAt` `string` _(required)_: When the session expires, as an ISO 8601 timestamp.
  - `token` `string` _(required)_: The session token.
  - `createdAt` `string` _(required)_: When the session was created, as an ISO 8601 timestamp.
  - `updatedAt` `string` _(required)_: When the session was last refreshed, as an ISO 8601 timestamp.
  - `ipAddress` `string`: IP address the session was created from.
  - `userAgent` `string`: User agent of the client that created the session.
  - `userId` `string` _(required)_: ID of the user the session belongs to.
- `user` `object` _(required)_: The signed-in user.
  - `id` `string` _(required)_: The user ID.
  - `name` `string` _(required)_: The user's display name.
  - `email` `string` _(required)_: The user's email address.
  - `emailVerified` `boolean`: Whether the email address has been verified.
  - `image` `string`: Profile image URL, when the auth provider supplied one.
  - `createdAt` `string` _(required)_: When the user was created, as an ISO 8601 timestamp.
  - `updatedAt` `string` _(required)_: When the user was last updated, as an ISO 8601 timestamp.
  - `isAnonymous` `boolean`: Whether this is an anonymous (guest) user.
  - `phoneNumber` `string`: The user's phone number, when one is linked.
  - `phoneNumberVerified` `boolean`: Whether the phone number has been verified.

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl 'https://api.openfort.io/iam/v2/auth/get-session?disableCookieCache=false'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/get-session?disableCookieCache=false')
```

## List sessions

`GET /iam/v2/auth/list-sessions`

List all active sessions for the user

### Responses

#### `200`: Success

Body (`application/json`):

- `id` `string` _(required)_: The session ID.
- `expiresAt` `string` _(required)_: When the session expires, as an ISO 8601 timestamp.
- `token` `string` _(required)_: The session token.
- `createdAt` `string` _(required)_: When the session was created, as an ISO 8601 timestamp.
- `updatedAt` `string` _(required)_: When the session was last refreshed, as an ISO 8601 timestamp.
- `ipAddress` `string`: IP address the session was created from.
- `userAgent` `string`: User agent of the client that created the session.
- `userId` `string` _(required)_: ID of the user the session belongs to.

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/list-sessions
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/list-sessions')
```

## Revoke session

`POST /iam/v2/auth/revoke-session`

Revoke a single session

### Request body (`application/json`)

- `token` `string` _(required)_: The token to revoke

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates if the session was revoked successfully

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/revoke-session \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "token": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/revoke-session', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    token: 'string'
  })
})
```

## Revoke sessions

`POST /iam/v2/auth/revoke-sessions`

Revoke all sessions for the user

### Request body (`application/json`)

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates if all sessions were revoked successfully

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/revoke-sessions \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/revoke-sessions', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({})
})
```

## Revoke other sessions

`POST /iam/v2/auth/revoke-other-sessions`

Revoke all other sessions for the user except the current one

### Request body (`application/json`)

### Responses

#### `200`: Success

Body (`application/json`):

- `status` `boolean` _(required)_: Indicates if all other sessions were revoked successfully

#### `400`: Bad Request. Usually due to missing parameters, or invalid parameters.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/revoke-other-sessions \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/revoke-other-sessions', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({})
})
```

## Refresh access token

`POST /iam/v2/auth/refresh-token`

Refresh the access token using a refresh token

### Request body (required) (`application/json`)

- `providerId` `string` _(required)_: The provider ID for the OAuth provider
- `accountId` `string | null`: The account ID associated with the refresh token
- `userId` `string | null`: The user ID associated with the account

### Responses

#### `200`: Access token refreshed successfully

Body (`application/json`):

- `tokenType` `string`: Type of the provider token, usually `Bearer`.
- `idToken` `string`: OpenID Connect ID token from the provider, when it issued one.
- `accessToken` `string`: Access token issued by the linked social provider.
- `refreshToken` `string`: Refresh token issued by the provider, when available.
- `accessTokenExpiresAt` `string <date-time>`: When the access token expires, as an ISO 8601 timestamp.
- `refreshTokenExpiresAt` `string <date-time>`: When the refresh token expires, as an ISO 8601 timestamp.

#### `400`: Invalid refresh token or provider configuration

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/refresh-token \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "providerId": "string",
  "accountId": "string",
  "userId": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/refresh-token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    providerId: 'string',
    accountId: 'string',
    userId: 'string'
  })
})
```

## Get access token

`POST /iam/v2/auth/get-access-token`

Get a valid access token, doing a refresh if needed

### Request body (required) (`application/json`)

- `providerId` `string` _(required)_: The provider ID for the OAuth provider
- `accountId` `string | null`: The account ID associated with the refresh token
- `userId` `string | null`: The user ID associated with the account

### Responses

#### `200`: A Valid access token

Body (`application/json`):

- `tokenType` `string`: Type of the provider token, usually `Bearer`.
- `idToken` `string`: OpenID Connect ID token from the provider, when it issued one.
- `accessToken` `string`: Access token issued by the linked social provider.
- `refreshToken` `string`: Refresh token issued by the provider, when available.
- `accessTokenExpiresAt` `string <date-time>`: When the access token expires, as an ISO 8601 timestamp.
- `refreshTokenExpiresAt` `string <date-time>`: When the refresh token expires, as an ISO 8601 timestamp.

#### `400`: Invalid refresh token or provider configuration

#### `401`: Unauthorized. Due to missing or invalid authentication.

Body (`application/json`):

- `message` `string` _(required)_: Human-readable outcome message.

#### `403`: Forbidden. You do not have permission to access this resource or to perform this action.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `404`: Not Found. The requested resource was not found.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `429`: Too Many Requests. You have exceeded the rate limit. Try again later.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

#### `500`: Internal Server Error. This is a problem with the server that you cannot fix.

Body (`application/json`):

- `message` `string`: Human-readable outcome message.

### Example request

```bash
curl https://api.openfort.io/iam/v2/auth/get-access-token \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "providerId": "string",
  "accountId": "string",
  "userId": "string"
}'
```

```ts
fetch('https://api.openfort.io/iam/v2/auth/get-access-token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    providerId: 'string',
    accountId: 'string',
    userId: 'string'
  })
})
```