ElvixSessions

Live session list scoped per-app or per-account, with per-row revoke and a two-CTA mass-revoke confirm pane.

app/security/sessions/page.tsx

"use client";

import { ElvixSessions } from "@elvix.is/sdk/react";

export default function SecuritySessionsPage() {
  // No appId needed: it defaults to the clientId on <ElvixProvider>, so
  // this lists the user's sessions in YOUR app and nothing else.
  return (
    <ElvixSessions
      signInUrl="/sign-in"
      onChanged={() => {
        // Refetch any host-side session count or device badge.
      }}
    />
  );
}

Props

Prop	Type	Required	Default	Description
`appId`	`string`	optional	the `clientId` on `<ElvixProvider>`	The app whose sessions to list. Accepts EITHER your public clientId OR the internal Application.id. Since 0.11.0 you do not need to pass it: it defaults to the app the provider is configured for, so a customer app gets its own sessions and only its own. It falls through to the user's global elvix-account list ONLY when the provider has no clientId, which is elvix's own first-party account surface.
`signInUrl`	`string \| null`	optional	`/sign-in/account`	Where the SDK navigates after the sign-out-everywhere path completes. Pass `null` (since 0.13.0) to navigate yourself from `onResult`, after your own sign-out cleanup.
`onChanged`	`() => void`	optional	`undefined`	Fires after any successful revoke so the host can refetch ambient counts.
`onResult`	`(r: ElvixSessionsResult) => void`	optional	`undefined`	Terminal callback per revoke attempt. Carries `action` kind and `ended` count on success. No session IDs leak to the host.

The sign-out-everywhere path ends this device the same way signOut() does: it clears the SDK token, the elvix_token cookie and sets the signed-out flag that stops the sign-in page from resuming the old session. Then onResult fires with ok: true, then the SDK navigates to signInUrl, unless you passed signInUrl={null}. The sign-out-others path keeps the current session and resolves with an in-frame done pane.

Reacting to terminal results

onResult is a discriminated union. The success branch carries action (the revoke kind) and ended (the number of closed sessions). A host that keeps its own session (an httpOnly cookie, a server session) passes signInUrl={null} and navigates from onResult after tearing that down, so its cleanup cannot race the SDK's redirect.

app/security/sessions/page.tsx (with onResult)

"use client";

import { ElvixSessions } from "@elvix.is/sdk/react";
import { signOutOfHost } from "@/lib/auth";

export default function SecuritySessionsPage() {
  return (
    <ElvixSessions
      signInUrl={null}
      onResult={async (r) => {
        if (!r.ok) {
          console.warn("sessions revoke failed", r.error, r.message);
          return;
        }
        if (r.action === "sign_out_all") {
          // The SDK has already cleared its token and the elvix_token cookie.
          // Clear your own session, then leave.
          await signOutOfHost();
          window.location.replace("/sign-in");
        }
      }}
    />
  );
}

Ban / pause / delete watcher

Mount once in any authenticated layout. When the user's membership flips off active, the watcher paints a full-screen blocking modal with a 9-second countdown, then signs them out and redirects.

Read

ElvixExport

In-frame OTP-gated GDPR data export wizard (preview, send-to, otp, done) for identity or per-app scope.