API for getting all active sessions?

[tamx]

I don't see a way to get a list of active sessions. Is there a reason for this? For security reasons, I believe you should revoke sessions you don't know.

[ianklatzco]

There are two tokens: access and refresh.

Access tokens last for 120 minutes.

Refresh tokens last for 90 days.

atproto/packages/pds/src/auth.ts

Lines 44 to 68 in a832c54

	createAccessToken(opts: {
	did: string
	scope?: AuthScope
	expiresIn?: string | number
	}) {
	const { did, scope = AuthScope.Access, expiresIn = '120mins' } = opts
	const payload = {
	scope,
	sub: did,
	}
	return {
	payload: payload as AuthToken, // exp set by sign()
	jwt: jwt.sign(payload, this._secret, {
	expiresIn: expiresIn,
	mutatePayload: true,
	}),
	}
	}
	createRefreshToken(opts: {
	did: string
	jti?: string
	expiresIn?: string | number
	}) {
	const { did, jti = getRefreshTokenId(), expiresIn = '90days' } = opts

It looks like there might not even be a way to change your password exposed in the UI currently!

[ianklatzco]

There is a getSession:
https://github.com/bluesky-social/atproto/blob/ece4b61d50543dc145c52265a77ad47ae36cb09d/lexicons/com/atproto/server/getSession.json

[tamx]

Maybe it's the current session and I think it's different from the intention of this Q&A.