Skip to content

List the caller's active device and web sessions.

GET
/v1/auth/sessions
curl --request GET \
--url https://api.share2.us/v1/auth/sessions \
--header 'Authorization: Bearer <token>'

Requires an INTERACTIVE login: a personal API token is refused with 403 session_required. The listing carries each machine’s name, fingerprint and last address, and revocation can lock the owner out of their own devices, so a CI token must not reach either. Firebase browser requests need a valid X-Session-Id; the scoped X-Session-Manage-Token issued by web-session registration when the session cap is reached is also accepted, and is itself refused for a suspended or pending-deletion account.

X-Session-Manage-Token
string

Short-lived scoped token accepted only by session list/revoke routes.

Sessions for the authenticated account.

Media typeapplication/json
object
sessions
required
Array<object>
object
id
required
string format: uuid
device_name
required
string
os
string
client_info
string
machine_id

Short display fingerprint, not the raw machine id.

string
created_at
required
string format: date-time
last_used_at
string format: date-time
expires_at
required
string format: date-time
revoked_at
string format: date-time
created_ip
string
last_ip
string
last_country
string
client_type
required
string
Allowed values: cli web
public_key
string
current
required
boolean
Example
{
"sessions": [
{
"client_type": "cli"
}
]
}

Missing browser session (session_required) or invalid scoped token.

Standard error envelope.

Media typeapplication/json
object
error
required
object
code
required
string
message
required
string
request_id
required
string
Example
{
"error": {
"code": "quota_exceeded"
}
}