​

crewship session

1. Audit who’s logged in — session list shows device, IP, and last-seen for every active session. Pipe through jq for compliance reports without opening a browser.
2. Force logout — session revoke kills one session by id. Combined with whoami and token revoke it gives an admin everything needed to neutralise a leaked credential.

crewship session <subcommand>

​

Subcommands

​

Flags

​

Examples

​

List

crewship session list
# ID                STATUS   CREATED           LAST USED         IP             USER AGENT
# sess_abc1234567   current  2026-05-19 09:02  2026-05-19 14:51  10.0.4.7       Mozilla/5.0 (Macintosh; In
# sess_xyz9876543   stale    2026-04-30 11:18  2026-05-18 16:30  198.51.100.42  Mozilla/5.0 (Windows NT 1

​

Audit dump for compliance

crewship session list --format json | jq '
  .[] | {id, ip, last_used: .last_used_at, ua: .user_agent}
'

​

Revoke another session

crewship session revoke sess_xyz9876543
# ✓ Session sess_xyz9876543 revoked.

​

Revoke your own session

crewship session revoke sess_abc1234567
# ✓ Session sess_abc1234567 revoked.
# Note: that was your current session — re-run 'crewship login' to continue.

​

Security notes

• Foreign session ids (sessions belonging to other users) return 404 with the same shape as “does not exist”, so the endpoint can’t be used to enumerate other users’ sessions by id.
• Revoking a session does not invalidate any CLI tokens that user holds. CLI tokens have their own lifecycle — manage them under Settings → CLI tokens or via crewship token revoke.

​

Common errors

• 404 Not Found — the session id doesn’t exist or it belongs to another user. Indistinguishable on purpose.
• 401 unauthorized — your current session was revoked. Run crewship login.

​

See also

• crewship login — re-authenticate after a self-revoke.
• crewship whoami — verify the active token is still valid.
• crewship token — CLI token lifecycle, separate from browser sessions.
• Auth API — GET /api/v1/auth/sessions.