Sessions
How long a Gigadrive sign-in lasts, what a session records, and when you are asked to prove it is you again.
A session is what a completed sign-in leaves behind. It is shared across every Gigadrive product on gigadrive.de, which is why signing in to the console also signs you in to your account pages.
Lifetime
Every session expires 30 days after it was created.
Nothing extends that window. Using the session updates when it was last seen, not when it runs out, so a browser you keep signed in still asks for credentials a month after you first used it.
What a session records
| Field | Why it exists |
|---|---|
| User agent and IP address | Attribution, and the request context stamped onto audit log entries |
| Last used at | The most recent request that presented the session |
| Last authenticated at | The most recent time credentials were checked. The re-authentication rules read this value |
| Last authentication method | One of PASSWORD, SOCIAL, PASSKEY, TOTP, EMAIL, SECURITY_KEY |
| Revoked | Set by sign-out, and checked on every request |
The method matters beyond bookkeeping. An OAuth client can restrict which methods it accepts, and that restriction is re-evaluated against this field every time the authorization endpoint runs, rather than once at sign-in.
Re-authentication
Some actions require credentials proven within the last 15 minutes, no matter how fresh the session is otherwise.
That covers everything on the security page: setting or changing a password, enabling email verification, enrolling an authenticator app, registering a passkey, and disabling a factor. When the window has passed, the page opens a re-authentication prompt and retries the action for you once you clear it.
Changing your password also signs out every other session on your account. The session you changed it from stays signed in. Every Gigadrive product recognizes the browser's built-in "change password" action and opens the security page directly to that form.
There is no session list yet
Nothing in the account app shows where you are signed in, and there is no "sign out everywhere" control. Signing out
ends the session in front of you and no other. If you believe a session is in the wrong hands, write to
cs@gigadrive.de.
Machine credentials are not sessions
An API key never produces a session. It is exchanged for a bearer token that lives five minutes and acts as the application it belongs to rather than as you, so nothing about your sign-in changes when a key is created or revoked.