Manage your account, password and sessions
Change your password, see every device you are signed in on, and sign the others out.
Owned by Member · 6 steps · about 10 minutes
Why this exists
Account self-service on this platform is built around one rule: a member may see and end their own sessions, and nothing else. There is no self-service delete, no self-service group request, and no way to look at anyone else's anything.
The password change is the interesting part. Changing your password revokes every other session immediately and keeps only the one you are using. That is the built behaviour of "my account is compromised": one action, all other devices out, no waiting for a token to expire. Sessions are re-read on every request, so a revocation is effective on the very next click rather than at the next login.
The step that surprises people is deactivation, which only an admin can do. Deactivating an account does not just block login — it revokes every live door pass the user holds, blacklists the serials and pushes a void to their wallet. A pass never authenticates a session, so without that step a banned member's phone would keep opening doors for months.
Before you start
- A member session (any registered account).
- An admin session for the participant steps.
Practise with
| Persona | Password | Note | |
|---|---|---|---|
| member | member@club.test | member123 | if you change this password, change it back — other workflows use it |
| admin | admin@club.test | admin123 | grants, revokes and deactivations |
Steps 1–4 — Member
their manual →-
1Open your account page and read the three blocks: profile, grants and zones, active sessions.Expected result One row per live session with where and when it was created, and your current one marked.
-
2Look at the same facts as JSON — it is the cleanest way to see what the server thinks you are.Expected result Your user, your groups with any event scope, your zones both global and per event, and your session expiry.Watch out for A scoped grant (a host on one event) contributes zones only for that event. Globally it contributes nothing, which is why a promoter's card does not open the building on someone else's night.
-
3Change your password. You need the current one.Expected result Success, and every other session of yours is signed out on the spot.Watch out for A wrong current password is a 401 and nothing changes. And be deliberate on a shared demo database: the seeded logins are documented in this manual, so changing one breaks the next trainee.
-
4Sign out one specific session — the laptop you left at a friend's flat.Expected result That session dies immediately; the list refreshes without it.Watch out for You can only revoke your own sessions; someone else's id is a 404, not a 403, so ids cannot be probed. Revoking the session you are currently using logs you out and drops you at the home page.
Steps 5–6 — Admin
their manual →Owns everything a member cannot do to their own account: groups, deactivation, forced sign-out.
-
5As an admin, open a member and look at what only you can do: grant or revoke a group with a written reason, force every session out, deactivate.Expected result The grant timeline, the session list and the deactivate control.Watch out for A reason is required on every grant and revoke. This is enforced by the service, not the form — the API refuses a blank reason too.
-
6Deactivate a throwaway account and then look at the access dashboard.Expected result The user's passes appear in the revocation list with a wallet void recorded against them.Watch out for Pass revocation is terminal. Reactivating the account re-mints a membership card but does NOT bring event-ticket passes back — those tickets need re-issuing. Never deactivate an account as a way of 'pausing' someone.