Sessions come up in every product meeting eventually. Someone asks why a user was signed out, or how long people stay signed in, and the answer is full of words like JWT and refresh token. Here’s the same answer in plain language.

Two keys, one short and one long

When someone signs in, they get two things: a short-lived pass that proves who they are for about a minute, and a long-lived key that can quietly fetch a new pass. Your app only ever checks the short pass, so it can do that quickly without asking our servers every time.

Signing out everywhere

Because the short pass expires so quickly, revoking the long key signs someone out of every device within a minute. That’s what happens when a user clicks “Revoke session”, or when an admin removes them from an organization.

Why tabs stay in sync

Open the app in three tabs and sign out in one. The others notice within a second, because they share the same long key and listen for changes. Nobody ends up half signed in.