# Limit concurrent sessions per user account **URL:** \ **Category:** Miscellanaeous\ **Created:** [January 8, 2020, 7:25am UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866 "2020-01-08T07:25:55Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![anish](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@anish](https://forum.keycloak.org/u/anish)\ **Post date:** [January 8, 2020, 7:25am UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/1 "2020-01-08T07:25:55Z")
Hi, Is it possible to limit number of concurrent active sessions per user in keycloak. Can someone help me out to achieve this ? Thanks Anish ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [January 8, 2020, 8:21am UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/2 "2020-01-08T08:21:49Z")
Keycloak has not ootb feature for this. I once implemented an “only one session per user” behavior with an `EventListenerProvider`. On every `LOGIN` event, I deleted all the sessions of an user, except the current one. HTH, regards, Niko ---
**Author:** ![anish](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@anish](https://forum.keycloak.org/u/anish)\ **Post date:** [January 8, 2020, 3:49pm UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/3 "2020-01-08T15:49:00Z")
Thanks Niko, Let me try to implement it ! ---
**Author:** ![anish](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@anish](https://forum.keycloak.org/u/anish)\ **Post date:** [January 14, 2020, 4:07pm UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/4 "2020-01-14T16:07:12Z")
Hi Niko, As suggested by you, i am able to remove active sessions associated to a user by capturing LOGIN event. But access token is not getting invalidated even after removal of session. Can you please help on this. Thanks, Anish ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [January 14, 2020, 9:59pm UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/5 "2020-01-14T21:59:44Z")
You can’t invalidate access tokens. Access tokens, once issued, are valid until their expiry timestamp. That’s the concept behind self-contained access tokens in JWT format, thus the term “self-contained” - you don’t need necessarily a 3rd party to validate and introspect the token. With session invalidation, you can only achieve, that a user is not able to get a new/refreshed access token, once he (or the resource server) tries to refresh its access token with the refresh token. ---
**Author:** ![edmaputra](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/edmaputra/32/688_2.png) [@edmaputra](https://forum.keycloak.org/u/edmaputra)\ **Post date:** [May 26, 2020, 11:45am UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/6 "2020-05-26T11:45:02Z")
Hi @dasniko I also want to implement this feature in my keycloak. Can i know which Keycloak API did you use to deleting the sessions ? I currently try with KeycloakSession in my SPI but it doesn’t work. ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [May 26, 2020, 11:46am UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/7 "2020-05-26T11:46:34Z")
> **[GitHub - dasniko/keycloak-session-restrictor: Simple event-listener for...](https://github.com/dasniko/keycloak-session-restrictor)** > > Simple event-listener for Keycloak which restricts the current user sessions to one (last one wins) only. Demo purposes only! - GitHub - dasniko/keycloak-session-restrictor: Simple event-listener f... ---
**Author:** ![edmaputra](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/edmaputra/32/688_2.png) [@edmaputra](https://forum.keycloak.org/u/edmaputra)\ **Post date:** [May 26, 2020, 11:50am UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/8 "2020-05-26T11:50:23Z")
Thanks @dasniko for your help. ---
**Author:** ![niraj](https://avatars.discourse-cdn.com/v4/letter/n/7ba0ec/32.png) [@niraj](https://forum.keycloak.org/u/niraj)\ **Post date:** [August 4, 2020, 6:45am UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/9 "2020-08-04T06:45:39Z")
Hi, I have implemented same in my project to limit concurrent sessions per user account, but here facing an issue when refreshing the page. Keycloak giving 400 response { “error”: “invalid\_grant”, “error\_description”: “Code not valid” } Can you please help me for this Thanks Niraj ---
**Author:** ![maradanasai](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/maradanasai/32/6180_2.png) [@maradanasai](https://forum.keycloak.org/u/maradanasai)\ **Post date:** [July 14, 2022, 10:23am UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/10 "2022-07-14T10:23:24Z")
@dasniko I think recently they have provided the support for this feature but not sure how to implement this. I’m not able to find the `User session count limiter` feature option as mentioned [here](https://github.com/keycloak/keycloak-documentation/blob/main/server_admin/topics/authentication/flows.adoc) Kindly help ---
**Author:** ![saeidrastak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/saeidrastak/32/7046_2.png) [@saeidrastak](https://forum.keycloak.org/u/saeidrastak)\ **Post date:** [November 17, 2022, 4:09pm UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/11 "2022-11-17T16:09:39Z")
@maradanasai I checked it Keycloak V20.0.1 and it works nice. Thanks for sharing this. you saved my life 🕶 ---
**Author:** ![Rekofithez](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rekofithez/32/9345_2.png) [@Rekofithez](https://forum.keycloak.org/u/Rekofithez)\ **Post date:** [November 29, 2023, 3:13pm UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/12 "2023-11-29T15:13:16Z")
Hi there ! could you explain shortly how did you make it please ? I’m using keycloak 21.0.1. thanks ! ---
**Author:** ![jame-developer](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jame-developer/32/7931_2.png) [@jame-developer](https://forum.keycloak.org/u/jame-developer)\ **Post date:** [January 8, 2024, 9:08am UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/13 "2024-01-08T09:08:08Z")
What about the user session limiter in the authentication flows? Isn’t it made for that purpose? see also [Server Administration Guide](https://www.keycloak.org/docs/latest/server_admin/#_user_session_limits) ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [February 9, 2024, 12:20pm UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/15 "2024-02-09T12:20:15Z")
- How does your post relate to this thread? Please never bomb different threads with your requests which cover other topics. - Please never ask one person directly, always post you questions as brought as possible to the community with as much as possible details. This way, chances are high to get an answer. Thanks for your understanding. ---
**Author:** ![ahmad](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ahmad/32/9736_2.png) [@ahmad](https://forum.keycloak.org/u/ahmad)\ **Post date:** [February 9, 2024, 12:56pm UTC](https://forum.keycloak.org/t/limit-concurrent-sessions-per-user-account/866/16 "2024-02-09T12:56:46Z")
I apologize for the confusion and any inconvenience caused. I realize now that my post was not directly related to this thread, and I understand the importance of staying on topic. I am committed to following the community guidelines going forward and ensuring that my contributions are relevant and respectful. Thank you for bringing this to my attention, and I appreciate your understanding.