Help Screens Account & security
Security ACC-04
Password, two-factor and active sessions in one place.
| Who can use it | Self |
|---|---|
| Where it is | /account/security · link: https://hub.substratalapps.com/account/security or substratal://account/security |
| Available on | Web (PWA), iOS / iPadOS, Android, Windows, Linux (GNOME), macOS |
| Phase | MVP |
What you can do here
- Revoke one — Optimistic remove; 404 → already gone, refresh.
- Sign out everywhere else — Confirm first (COPY).
keep_currentkeeps this device signed in (logout all_sessionswould sign it out too). 200{revoked}→ toast "Signed out of {n} other sessions", refresh the list. Revoking a session deactivates the push devices it registered.
Related guides
- Signing in and keeping your account secure — Sign in, two-factor authentication, sessions and signing out everywhere.
On your platform
| App | Status | How it's built |
|---|---|---|
| Web (PWA) | — | Grouped settings rows in main pane |
| iOS / iPadOS | — | Inset-grouped List/Form |
| Android | Planned | Grouped ListItems |
| Windows | — | Page of SettingsCards |
| Linux (GNOME) | — | AdwPreferencesPage |
| macOS | — | Detail column Form(.grouped); per-row save |
Status is reported by each app's repository; — means that app doesn't report it yet.
For developers: API calls
| Method | Path | What it does |
|---|---|---|
| GET | /users/{id}/sessions | List active sessions (self or users.manage) |
| POST | /users/{id}/sessions/revoke-all | Revoke every session (self or users.manage) |
| DELETE | /users/{id}/sessions/{sessionId} | Revoke one session |
| GET | /users/{id} | Fetch one user |
Every call sends Substratal-Version: 1. Paths are at the host root, with no /v1.