# Session Account Too many sessions?

**URL:** <https://forum.keycloak.org/t/session-account-too-many-sessions/9638>\
**Category:** Miscellanaeous\
**Created:** [June 17, 2021, 5:16pm UTC](https://forum.keycloak.org/t/session-account-too-many-sessions/9638 "2021-06-17T17:16:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![marquez2012](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/marquez2012/32/3295_2.png) [@marquez2012](https://forum.keycloak.org/u/marquez2012)\
**Post date:** [June 17, 2021, 5:16pm UTC](https://forum.keycloak.org/t/session-account-too-many-sessions/9638/1 "2021-06-17T17:16:56Z")

</div>

Hi guys,

On my keycloak server I activated the Service account and I realize that there’re a lot of sessions created for this user. For instance, after the first login is created 22 service accounts sessions… and after a while this number increases a lot since a new session is created every 15s (+/-).

Is this behavior normal? If not how can I change this?  
Thanks in advance

Some screenshots

 ![keycloak_3](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/d/d786205f0b59ec687e0d60295e15e605cb8b7fd2.png)

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [June 17, 2021, 6:18pm UTC](https://forum.keycloak.org/t/session-account-too-many-sessions/9638/2 "2021-06-17T18:18:49Z")

</div>

> [@marquez2012](#):
>
> Is this behavior normal?

Are you calling the token endpoint `/auth/realms/{realm_name}/protocol/openid-connect/token` each time before you make a request? A common case is that people use their service account to make API requests, calling the token endpoint before each request, or when the access token expires. If you are using it this way, sessions will build up. A way to prevent this would be to call the token endpoint once, and then use the refresh token to get new access tokens until the refresh token expires. That will prevent buildup of sessions like this.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [June 17, 2021, 6:28pm UTC](https://forum.keycloak.org/t/session-account-too-many-sessions/9638/3 "2021-06-17T18:28:09Z")

</div>

IIRC the refresh token was removed from the response when it’s client flow, and service accounts are client flow. This is to be more OAuth2 spec conform.

But anyway, the access token can be used as long as it is valid (and this is intended!). Only when it is expired, one will need to re-authenticate.