Sessions & session policy
How Relay sessions work, revoking them, and organization-wide session policy.
Each time you sign in — to the dashboard or the CLI — you create a separate session. The Sessions page lists your active sessions (device, CLI) and lets you revoke any of them.
Revocation takes effect immediately server-side: a revoked session can no longer make requests. Regardless of role, you may always view and revoke your own sessions.
Session policy (Enterprise)
Organization owners and admins can set an organization-wide session policy under Organization > Authentication. It controls dashboard sign-ins with two limits:
| Setting | What it does | Default |
|---|---|---|
| Idle timeout | Signs a person out after this long without activity; the deadline slides forward while they use the dashboard. | 24 hours |
| Maximum session length | Ends a session this long after sign-in, however active it is. | 30 days |
Shortening a limit also applies to people who are already signed in (existing
sessions are tightened within the hour); lengthening one applies from their next
sign-in. CLI token TTL sets how long a CLI login lasts and is configured
separately. The same values are available as session_idle_timeout_minutes,
session_absolute_max_hours and cli_token_ttl_hours on the organization update API.
Org-wide session policy is an Enterprise feature. Combine it with SSO so re-authentication flows through your identity provider.
Administrators can also revoke another user's sessions (e.g. during offboarding) with the appropriate permission.