Hi all. I wanna that user can have on;y one session per one time. If he has a session on his pc and he logged in via phone - his pc session will be killed. How I can do that with keycloak? I tried to do that on my nodejs app (logout user before his login) via post request to /auth/master/users/:id…

I saw this topic. But how I can invalidate refresh token?

@dasniko In this api doc there is no endpoint for this and endpoint for logout didn’t work https://www.keycloak.org/docs-api/5.0/rest-api/index.html may be you can provide link with active API and in the best way - link to endpoint for invalidating of refresh token

You don’t need to invalidate the refresh_token. When you kill the session(s), a refresh_token for a killed session is useless, it won’t be able to refresh an access_token. Thus, killing a session is similar to revoke refresh_tokens.

@dasniko okay, how i can kill session via API? can u send me correct endpoint, 'cause for now i can see only endpoints which will send 404 as response

The API you’re looking for is the Keyloak SPI API, no REST API. There’s no endpoint you can call to kill sessions. As I already wrote in the other, above linked post, you’ll have to use a EventListenerProvider. I put mine online here: https://github.com/dasniko/keycloak-session-restrictor Please r…

Only one session for user

Getting advice

dasniko February 26, 2020, 8:30pm 2

Just use the search function of this forum, it works!: Limit concurrent sessions per user account

Topic		Replies	Views
Limit concurrent sessions per user account Miscellanaeous	14	27450	February 9, 2024
Allow only one session per user source Getting advice authentication , oidc	0	917	October 20, 2022
Issues with session invalidation Getting advice authentication , oidc	3	201	March 26, 2025
Logout from only a specific client_id using the Admin REST API Miscellanaeous	2	1895	November 10, 2025
Unable to invalidate user session using keycloak-js Getting advice oidc	0	1186	February 6, 2020

Only one session for user

Related topics