Session Timeout

Last Updated: October 23, 2026

The Session timeout tab lets you control how long users can remain inactive before being signed out, how often session tokens refresh, and whether to limit concurrent sessions. These settings apply across the Vasion platform.

Key Points

Review the following key points:

  • Session timeout settings apply independently to four access types: Web console and external links.
  • Each access type has two configurable values: An idle timeout and a token refresh interval.
  • Changes to session timeout settings apply only to new sessions. Existing active sessions continue using the prior settings.
  • When you change a user's role, Vasion Automate prompts you to revoke the user's active sessions and require reauthentication.
  • The audit log records changes to session timeout settings.

How Session Timeout Works

Idle Timeout

The idle timeout determines how long a user can be inactive before being automatically signed out. A user is considered inactive when they have not made any selections, navigation actions, or application programming interface (API) requests in the platform. Activity in any tab or window of the same access type keeps the session active. Activity outside of the platform does not reset the timer.

When the idle timeout elapses, the session ends and returns the user to the sign-in page.

Token Refresh

Authentication tokens verify user identity and grant system access without repeatedly entering passwords. A token serves as a substitute for more sensitive information, making computer systems both more secure and efficient.

The token refresh interval determines how often the JSON Web Token (JWT) silently renews while the user is active. Shorter refresh intervals improve security by reducing the window in which a compromised token can be used.

Access Types

You configure session timeout settings independently for each of the following access types:

  • Web console: Admin Console and Self-service Portal.
  • External links: Password reset and shared links.

Session Override for Admin

The session override option forces all admin user sessions in the web console to time out after 10 minutes of inactivity. This override applies regardless of the idle timeout configured for the web console access type. This option does not affect other access types.

Concurrent Sessions

By default, each user can be signed in on an unlimited number of devices or browsers at the same time. You can turn on the Limit concurrent sessions option and set a maximum number of simultaneous sessions per user. Reaching the limit revokes the oldest session.

Revoke an Active Session

You can immediately end a user's active session by revoking it from the Users page. When you revoke a session, the session ends and the user returns to the sign-in page.

Deactivating a user account also ends all of that user's active sessions.

Role Change & Session Revocation

When you change a user's role, Vasion Automate prompts you to choose whether to revoke the user's active sessions and require reauthentication. If you confirm, all of the user's active sessions end. If you decline, the user's existing sessions continue under the previous role until they expire or the user signs out.

Requirements

Review the following requirements:

  • Admin or Root Admin role.
  • Vasion Automate access.

Next Steps

Refer to the following: