# Set custom session limits per user or device

On a [paid plan](https://clerk.com/pricing), you can now set session limits per user or device, beyond your instance's [custom session lifetime](https://clerk.com/docs/guides/secure/session-options.md) and [native app lifetime](https://clerk.com/changelog/2026-11-04-native-session-lifetimes.md). For example, enforce shorter sessions on a shared device, or longer ones at a user's choice. Clerk offers two ways to do this.

## Revoke sessions based on age from your application

Add the [`session.created_at` and `session.expire_at` shortcodes](https://clerk.com/docs/guides/sessions/jwt-templates.md#available-shortcodes) to your [custom session claims](https://clerk.com/docs/guides/sessions/customize-session-tokens.md) to read a session's age and expiry from its token, without calling the Backend API on each request:

```json
{
  "session_created_at": "{{session.created_at}}",
  "session_expire_at": "{{session.expire_at}}"
}
```

Your backend can then apply whatever rule you need, such as a different limit for business customers. When a session is past your limit, reject the request and [revoke the session](https://clerk.com/docs/reference/backend/sessions/revoke-session.md) using the `sid` claim. Revoking stops the session from getting new tokens, but the token it already has stays valid until it expires, so keep rejecting requests from that session. This approach can only end sessions sooner than your instance's lifetime.

## Change a single session's expiry

Use the Backend API to [update a session](https://clerk.com/docs/reference/backend-api/tag/sessions/PATCH/sessions/%7Bsession_id%7D) and set a new `expire_at`, between 5 minutes and 10 years from now. It can be earlier or later than your instance's lifetime.

- The change applies only to that session. New sign-ins still start from your instance's lifetime.
- Expired, revoked, and other ended sessions can't be revived, and impersonation and agent sessions can't be updated.
- The session's inactivity timeout, if it has one, still applies.
- Take the session ID from the `sid` claim of a verified session token, or from a verified webhook such as `session.created`. Never take it from an unverified client request.
- Each change is recorded as a `session.expiry.updated` event in [Admin Logs](https://clerk.com/docs/guides/dashboard/logs/admin-logs.md) and [Application Logs](https://clerk.com/docs/guides/dashboard/logs/application-logs.md).

## Change many sessions

Both approaches work on individual sessions. For a one-off expiry change across all active sessions, [contact support](https://clerk.com/contact/support).