Set custom session limits per user or device

On a paid plan, you can now set session limits per user or device, beyond your instance's custom session lifetime and native app lifetime. For example, enforce shorter sessions on a shared device, or longer ones at a user's choice. Clerk offers two ways to do this.

Revoke sessions based on age from your application

Add the session.created_at and session.expire_at shortcodes to your custom session claims to read a session's age and expiry from its token, without calling the Backend API on each request:

{
  "session_created_at": "{{session.created_at}}",
  "session_expire_at": "{{session.expire_at}}"
}

Your backend can then apply whatever rule you need, such as a different limit for business customers. When a session is past your limit, reject the request and revoke the session using the sid claim. Revoking stops the session from getting new tokens, but the token it already has stays valid until it expires, so keep rejecting requests from that session. This approach can only end sessions sooner than your instance's lifetime.

Change a single session's expiry

Use the Backend API to update a session⁠ and set a new expire_at, between 5 minutes and 10 years from now. It can be earlier or later than your instance's lifetime.

• The change applies only to that session. New sign-ins still start from your instance's lifetime.
• Expired, revoked, and other ended sessions can't be revived, and impersonation and agent sessions can't be updated.
• The session's inactivity timeout, if it has one, still applies.
• Take the session ID from the sid claim of a verified session token, or from a verified webhook such as session.created. Never take it from an unverified client request.
• Each change is recorded as a session.expiry.updated event in Admin Logs and Application Logs.

Change many sessions

Both approaches work on individual sessions. For a one-off expiry change across all active sessions, contact support.