loading
Preparing LoginRadius developer resources
Mission: Help enterprises accelerate digital transformation with our fully-managed Customer IAM technology.
Skip to main content

Login Sharing Restriction

Control how many devices or browsers a user can be simultaneously logged in from. When the session limit is exceeded you can block the login, warn the user, or silently revoke older sessions.
Session

Node Topology

User EntersAuth / Social AuthData QuerySessions.Count≥ NTrueFalseForce LogoutOutputSuccessSuccesstruefalse

How It Works

Two nodes work together to enforce session limits:

NodeRole
Data QueryEvaluates the number of active sessions the user currently has using the virtual field Sessions.Count
Force LogoutInvalidates all active sessions for the user except the current one, keeping the user logged in on the device where the action was triggered

Sessions.Count is computed live when the Data Query node executes. It counts sessions across all linked profiles for the user. If the lookup fails for any reason, the field is treated as absent and the rule evaluates to false: the user is not blocked.

Workflow Patterns

Show the user a screen explaining that their other sessions will be ended. The user confirms, and the workflow revokes the older sessions and proceeds.

StartAuth / Social AuthData QuerySessions.Count ≥ NTrueFalseWeb Pagesession limit screenForce Logoutrevoke other sessionsSuccessSuccesstruefalse

Use this when: You want to inform the user that their other sessions will be ended and give them a chance to acknowledge before proceeding.

Pattern 2: Silent Revocation

Older sessions are revoked automatically when the limit is reached, with no interruption to the user experience.

StartAuth / Social AuthData QuerySessions.Count ≥ NTrueFalseForce Logoutrevoke other sessionsSuccessSuccesstruefalse

Use this when: You want to enforce the limit with no user-visible interruption.

Pattern 3: Require Re-verification Before Revoking

Require the user to verify their identity via OTP before older sessions are revoked.

StartAuth / Social AuthData QuerySessions.Count ≥ NTrueFalseOTP VerificationSend + Verify OTPForce Logoutrevoke other sessionsSuccessSuccesstruefalse

Use this when: You want an extra security step before revoking sessions: for example, confirming the user is aware of and authorizing the revocation.

Setting Up Login Sharing Restriction

Prerequisites

  • An active Identity Orchestration workflow with at least one authentication node (Auth or Social Auth).

Step 1: Add a Data Query Node

  1. Open your workflow in the Admin Console under Platform Config → Authentication → Workflows.
  2. After your authentication node, add a Data Query node.
  3. Open the Data Query node's property panel and add a rule:
    • Field: Sessions.Count
    • Operator: >=
    • Value: your session limit (e.g. 3)
  4. Save the node.

Step 2: Wire the True Output

Connect the true output to whichever pattern you want to use when the limit is exceeded:

PatternTrue output wires to
Pattern 1 (warning screen)Session Limit Web Page → Force Logout
Pattern 2 (silent)Force Logout directly
Pattern 3 (re-verify)OTP Verification node → Force Logout

Step 3: Wire the False Output

Connect the false output directly to the Success Final node.

Step 4: Wire Force Logout to Success

Connect the Force Logout node's output to the Success Final node.

Step 5: Test the Flow

  1. Log in with the same account on more than N devices or browsers.
  2. On the next login attempt after the limit is reached, verify that the flow takes the true path.
  3. Confirm that older sessions are invalidated and the new session remains active.

Changing the Session Limit

Open the Data Query node in the workflow editor and update the threshold value (e.g. change >= 3 to >= 5). The change takes effect immediately for new login attempts: no redeployment required.

Important Considerations

TopicDetail
Current session is always keptForce Logout never revokes the session that triggered it. The user always completes login on their current device.
Linked accountsSessions across all linked profiles are counted and revoked, not just the primary profile.
Session count timingSessions.Count is evaluated before the new session's access token is issued, so the count reflects only pre-existing sessions.
Failure safetyIf the session count lookup fails, Sessions.Count is absent and the rule evaluates to false: the user is not blocked.
Token types countedOnly access tokens (full login sessions) are counted. Interim feature tokens (forgot password, PIN session, etc.) are excluded.
Limit is per-workflowEach workflow has its own session limit configured independently in its Data Query node.

Security note

The Force Logout node invalidates all sessions except the current one. If you have multiple workflows sharing the same user base, revoking sessions in one workflow affects sessions created by all workflows for that user.