Identity, devices and sessions

A device represents the longer-lived security context of a browser or endpoint. A session is the revocable access associated with that device.

One session can therefore be ended, or a complete device and all its sessions removed, without signing out every other endpoint.

Accounts with a registered security key receive no session after the password step alone. The WebAuthn confirmation completes authentication.

Passkeys reduce phishing risk, but do not prove that an endpoint is malware-free or physically controlled by the intended person.

• WebAuthn as an additional possession proof
• Device context remains bound to sign-in
• Removed devices remain revoked
• Failed attempts become security events

Users can review active sessions, end individual sessions, verify devices and remove devices. Administrators can revoke every session belonging to an account when required.

A panic function terminates active access and removes local security state. It does not replace an organisational incident-response process.

Browser device identity is not hardware attestation. Device verification confirms a controlled relationship between authorised endpoints, not operating-system integrity.